- openldap-technical - openldap.org

Constructed attributes?!
by Marco Gaiarin 26 Apr '23

26 Apr '23

There's some way, in OpenLDAP, to have attributed 'calculated on the fly' like the AD 'Constructed Attributes'? For a sake of an example, an attribute 'userStatus: disabled' if userPassword start with an '!'? Thanks. -- Di questa cavolo di pianura, di questa gente senza misura, che gia` confonde la notte e il giorno, e la partenza con il ritorno, e la richezza con i rumore, ed il diritto con il favore (F. De Gregori)

1 0

Write bottlenecks
by Sam Dave 26 Apr '23

26 Apr '23

Hi, My write pipelines have a bottleneck at the bottom (LMDB writing). Work piles on top up-front, waiting for LMDB writes to complete. Therefore the earlier work cannot really parallelize as much as it could if I could somehow make the writes go faster. Are there any tips/tricks around this? I wonder if it could pay off to parallelize the writes into a few LMDB environments - and merge them in the end. This could have the advantage of more parallelization on the up-front work, but disadvantage of the final merging work. Regards, Sam

1 0

leave
by Alceu Rodrigues de Freitas Junior 21 Apr '23

21 Apr '23

leave

1 0

openldap 2.3 and user passwords
by aurfalien 21 Apr '23

21 Apr '23

Hello list and Happy Friday. First and foremost I am not an OpenLDAP admin, well I guess that I am now for the purposes of this email. I’ve been thrust into an environment running an older version of openldap on CentoOS 5 and have been tasked to simply allow users in changing their passwords via passwd. Once a user has logged in on their respective workstation and types passwd we get this; Changing password for user johndoe. Current Password: New password: Retype new password: passwd: Authentication token manipulation error This tells me that I need to allow them self write access to userPassword Attribute of the LDAP database? However after reading a decent amount of literature, it's suggesting to use olcAccess but as far as I can tell this does not apply to my specific environment. All of the openldap data looks to be in /var/lib/ldap versus what I’ve been reading of /etc/openldap/slapd.d. The /etc/openldap/slapd.conf has this section which looks like what I should focus on; # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! It sounds like I should start here and see if this solves the issue. However where and how do I modify the default access control policy for this environment in allowing users to modify there userPassword attribute? Like I had mentioned, all of the reading thus far suggests olcAccess however my database is not in that format? Again very very new here and am forced to work with openldap 2.3 on a Centos 5 server for now. This is not to say that I would fair any better in a newer environment due to my lack of any real knowledge in this subject matter. At any rate thank you in advance. Humbly yours, - aurf

1 0

Use of olcTLSECName directive returns ‘wrong attibuteType’ error
by Lemons, Terry 20 Apr '23

20 Apr '23

Hi I’m attempting to modify the TLS ciphers that are used in an openldap2-2.4.41-22.16.1.x86_64 environment in our lab, running on SLES 12 SP5. I’ve used the following command to set the cipher list value to the returned value of ‘openssl ciphers HIGH’: ldpdd041:/tmp # cat set-ciphersuite.ldif dn: cn=config changetype: modify add: olcTLSCipherSuite olcTLSCipherSuite: HIGH ldpdd041:/tmp # ldapmodify -H ldapi:// -Y EXTERNAL -f set-ciphersuite.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "cn=config" ldpdd041:/tmp # openssl ciphers HIGH ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:SRP-DSS-AES-256-CBC-SHA:SRP-RSA-AES-256-CBC-SHA:SRP-AES-256-CBC-SHA:DH-DSS-AES256-GCM-SHA384:DHE-DSS-AES256-GCM-SHA384:DH-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:DH-RSA-AES256-SHA256:DH-DSS-AES256-SHA256:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DH-RSA-AES256-SHA:DH-DSS-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:DHE-DSS-CAMELLIA256-SHA:DH-RSA-CAMELLIA256-SHA:DH-DSS-CAMELLIA256-SHA:AECDH-AES256-SHA:ADH-AES256-GCM-SHA384:ADH-AES256-SHA256:ADH-AES256-SHA:ADH-CAMELLIA256-SHA:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-RSA-AES256-SHA384:ECDH-ECDSA-AES256-SHA384:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:CAMELLIA256-SHA:PSK-AES256-CBC-SHA:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:SRP-DSS-AES-128-CBC-SHA:SRP-RSA-AES-128-CBC-SHA:SRP-AES-128-CBC-SHA:DH-DSS-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:DH-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:DH-RSA-AES128-SHA256:DH-DSS-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:DH-RSA-AES128-SHA:DH-DSS-AES128-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-DSS-CAMELLIA128-SHA:DH-RSA-CAMELLIA128-SHA:DH-DSS-CAMELLIA128-SHA:AECDH-AES128-SHA:ADH-AES128-GCM-SHA256:ADH-AES128-SHA256:ADH-AES128-SHA:ADH-CAMELLIA128-SHA:ECDH-RSA-AES128-GCM-SHA256:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-RSA-AES128-SHA256:ECDH-ECDSA-AES128-SHA256:ECDH-RSA-AES128-SHA:ECDH-ECDSA-AES128-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:CAMELLIA128-SHA:PSK-AES128-CBC-SHA ldpdd041:/tmp # So I had expected to see that all of these ciphers were being offered for use by the OpenLDAP server; instead, I see that only a subset of the list is offered: sslyze ldpdd041.hop.lab.emc.com:636 . . . * TLS 1.0 Cipher Suites: Attempted to connect using 80 cipher suites. The server accepted the following 4 cipher suites: TLS_RSA_WITH_CAMELLIA_256_CBC_SHA 256 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA 128 TLS_RSA_WITH_AES_256_CBC_SHA 256 TLS_RSA_WITH_AES_128_CBC_SHA 128 The group of cipher suites supported by the server has the following properties: Forward Secrecy INSECURE - Not Supported Legacy RC4 Algorithm OK - Not Supported * TLS 1.1 Cipher Suites: Attempted to connect using 80 cipher suites. The server accepted the following 4 cipher suites: TLS_RSA_WITH_CAMELLIA_256_CBC_SHA 256 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA 128 TLS_RSA_WITH_AES_256_CBC_SHA 256 TLS_RSA_WITH_AES_128_CBC_SHA 128 The group of cipher suites supported by the server has the following properties: Forward Secrecy INSECURE - Not Supported Legacy RC4 Algorithm OK - Not Supported * TLS 1.2 Cipher Suites: Attempted to connect using 156 cipher suites. The server accepted the following 8 cipher suites: TLS_RSA_WITH_CAMELLIA_256_CBC_SHA 256 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA 128 TLS_RSA_WITH_AES_256_GCM_SHA384 256 TLS_RSA_WITH_AES_256_CBC_SHA256 256 TLS_RSA_WITH_AES_256_CBC_SHA 256 TLS_RSA_WITH_AES_128_GCM_SHA256 128 TLS_RSA_WITH_AES_128_CBC_SHA256 128 TLS_RSA_WITH_AES_128_CBC_SHA 128 I believe I know why the DHE-based ciphers are not being offered: I haven’t enabled use of the olcTLSDHParamFile directive. Rather than mess around with generating the DH param file, etc., I’d like to use ECDHE-based ciphers. According to p. 160 of https://www.openldap.org/doc/admin24/OpenLDAP-Admin-Guide.pdf, the ‘TLSECName’ directive allows an ECDHE curve to be specified. When I tried to enable use of the directive, I received a ‘wrong attibuteType’ error: ldpdd041:/tmp # cat set-ecname.ldif dn: cn=config changetype: modify add: olcTLSECName olcTLSECName : secp384r1 ldpdd041:/tmp # ldapmodify -H ldapi:// -Y EXTERNAL -f set-ecname.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 ldapmodify: wrong attributeType at line 4, entry "cn=config" ldpdd041:/tmp # Does OpenLDAP 2.4.41 not support this directive? Thanks tl Terry Lemons Senior Principal Software Engineer, Dell EMC Dell Technologies | Data Management Terry.Lemons(a)dell.com<mailto:Terry.Lemons@dell.com> Internal Use - Confidential

3 5

Re: Argon2-Support or secure hashing
by Braiam 14 Apr '23

14 Apr '23

On Thu, Apr 13, 2023 at 12:19 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > This is an annoying bit about the Debian/Ubuntu builds as > they strip that information out of the binary. I was curious about that, and Debian doesn't strip that information[1]: ldapadd -V ldapadd: @(#) $OpenLDAP: ldapmodify 2.5.13+dfsg-5 (Feb 8 2023 01:56:12) $ Debian OpenLDAP Maintainers <pkg-openldap-devel(a)lists.alioth.debian.org> (LDAP library: OpenLDAP 20513) I don't have an Ubuntu box at hand but their devel branch has the same patch[2] applied. If I trust that the datetime on the version string is the build date time, and since they use reproducible builds, I would guess that the base version is 2.5.6, from this changelog [3]. -- Braiam [1]: https://salsa.debian.org/openldap-team/openldap/-/blob/master/debian/patche… [2]: https://git.launchpad.net/ubuntu/+source/openldap/tree/debian/patches [3]: https://git.launchpad.net/ubuntu/+source/openldap/tree/debian/changelog?h=u…

4 6

How to get detailed connection error information?
by Jordan Brown 14 Apr '23

14 Apr '23

How can I get detailed information about connection errors - host not found, timed out, connection refused, various TLS errors, et cetera? -- Jordan Brown, Oracle ZFS Storage Appliance, Oracle Solaris

4 10

How to update UNIX+Samba password?
by Jan Andersen 14 Apr '23

14 Apr '23

I have OpenLDAP 2.4.57 on a Debian 11 server and Samba 4.13.13, on another Debian 11 system. When I create a new user in LDAP Account Manager (LAM), I can log in to the linux client systems, and I can connect using smbclient; and I can change the password successfully from LAM for both Samba and Linux. However, I can't do the same from the linux command line with 'passwd'. I have found several articles pointing me to smbk5pwd, which I have installed and configured according to https://bangdash.space/2021/01/syncing-ldap-passwords-with-samba/ - but it doesn't make a difference. Clearly I have not set it up correctly; I would be grateful if someone with more insight than myself could help me find the problem. I have run a session where user 'zzuser' changed their password from linux and the server ran: /usr/sbin/slapd -h "ldap:/// ldapi:/// ldaps:///" -g openldap -u openldap -F /etc/ldap/slapd.d -d -1 It generated 42715 lines of output, which I have saved, but I hesitate to dump it here. However, please let me know what information you need to help me.

1 0

pcache not working with dirx
by A. Schulze 13 Apr '23

13 Apr '23

Hello, I'm playing with the slapo-pcache overlay (openldap-2.6.4). Using the folloging configuration: ``` # https://www.openldap.org/doc/admin26/guide.html#The%20Proxy%20Cache%20Engine database ldap suffix dc=dirx,dc=example rootdn dc=dirx,dc=example uri ldap://dirx.example/ overlay pcache pcache mdb 1000 2 1000 20 pcacheAttrset 0 DKIMSelector pcacheTemplate (&(DKIMDomain=)(DKIMActive=)(DKIMKeyType=)) 0 10 pcacheAttrset 1 DKIMDomain DKIMSelector DKIMKey pcacheTemplate (DKIMSelector=) 1 10 directory /spool/dc=dirx,dc=example database ldap suffix dc=openldap,dc=example rootdn dc=openldap,dc=example uri ldap://openldap.example/ overlay pcache pcache mdb 1000 2 1000 20 pcacheAttrset 0 DKIMSelector pcacheTemplate (&(DKIMDomain=)(DKIMActive=)(DKIMKeyType=)) 0 10 pcacheAttrset 1 DKIMDomain DKIMSelector DKIMKey pcacheTemplate (DKIMSelector=) 1 10 directory /spool/dc=openldap,dc=example ``` One upstream server is DirX, the other openldap-2.6.4. Dirx don't work Openldap-cache is running with "slapd ... -d Config,Stats,pcache ..." this are the logs from a failing attempt: openldap-cache_1 | 643667a0.0584c8aa 0x7fa20ffff700 conn=1002 op=0 BIND dn="cn=reader,dc=dirx,dc=example" method=128 openldap-cache_1 | 643667a0.05b4d722 0x7fa20ffff700 conn=1002 op=0 BIND dn="cn=reader,dc=dirx,dc=example" mech=SIMPLE bind_ssf=0 ssf=71 openldap-cache_1 | 643667a0.05b5b312 0x7fa20ffff700 conn=1002 op=0 RESULT tag=97 err=0 qtime=0.000018 etime=0.003246 text= openldap-cache_1 | 643667a3.1cdab2c4 0x7fa214d35700 conn=1002 op=1 SRCH base="ou=Domains,dc=dirx,dc=example" scope=2 deref=0 filter="(&(DKIMDomain=dirxdomain.de)(DKIMActive=TRUE)(DKIMKeyType=rsa))" openldap-cache_1 | 643667a3.1cdada18 0x7fa214d35700 conn=1002 op=1 SRCH attr=DKIMSelector openldap-cache_1 | 643667a3.1cdb0450 0x7fa214d35700 query template of incoming query = (&(DKIMDomain=)(DKIMActive=)(DKIMKeyType=)) openldap-cache_1 | 643667a3.1cdb36bf 0x7fa214d35700 Entering QC, querystr = (&(DKIMDomain=dirxdomain)(DKIMActive=TRUE)(DKIMKeyType=rsa)) openldap-cache_1 | 643667a3.1cdb4254 0x7fa214d35700 Lock QC index = 0x5572682fc520 openldap-cache_1 | 643667a3.1cdb4e08 0x7fa214d35700 Not answerable: Unlock QC index=0x5572682fc520 openldap-cache_1 | 643667a3.1cdb5617 0x7fa214d35700 QUERY NOT ANSWERABLE openldap-cache_1 | 643667a3.1cdb5cec 0x7fa214d35700 QUERY CACHEABLE openldap-cache_1 | 643667a3.1d40534b 0x7fa214d35700 conn=1002 op=1 SEARCH RESULT tag=101 err=0 qtime=0.000014 etime=0.006697 nentries=0 text= and for a query to the openldap backend it works: openldap-cache_1 | 6436693c.35c382c5 0x7fa20ffff700 conn=1007 op=0 BIND dn="cn=reader,dc=openldap,dc=example" method=128 openldap-cache_1 | 6436693c.3663bbec 0x7fa20ffff700 conn=1007 op=0 BIND dn="cn=reader,dc=openldap,dc=example" mech=SIMPLE bind_ssf=0 ssf=71 openldap-cache_1 | 6436693c.36643fe0 0x7fa20ffff700 conn=1007 op=0 RESULT tag=97 err=0 qtime=0.000031 etime=0.010584 text= openldap-cache_1 | 64366940.08541952 0x7fa214d35700 conn=1007 op=1 SRCH base="ou=Domains,dc=openldap,dc=example" scope=2 deref=0 filter="(&(DKIMDomain=openldapdomain.de)(DKIMActive=TRUE)(DKIMKeyType=ed25519))" openldap-cache_1 | 64366940.08543f48 0x7fa214d35700 conn=1007 op=1 SRCH attr=DKIMSelector openldap-cache_1 | 64366940.0854686a 0x7fa214d35700 query template of incoming query = (&(DKIMDomain=)(DKIMActive=)(DKIMKeyType=)) openldap-cache_1 | 64366940.08547707 0x7fa214d35700 Entering QC, querystr = (&(DKIMDomain=openldapdomain.de)(DKIMActive=TRUE)(DKIMKeyType=ed25519)) openldap-cache_1 | 64366940.08547fde 0x7fa214d35700 Lock QC index = 0x5572682fda70 openldap-cache_1 | 64366940.08548a4b 0x7fa214d35700 Not answerable: Unlock QC index=0x5572682fda70 openldap-cache_1 | 64366940.0854925c 0x7fa214d35700 QUERY NOT ANSWERABLE openldap-cache_1 | 64366940.085499d1 0x7fa214d35700 QUERY CACHEABLE openldap-cache_1 | 64366940.0868a233 0x7fa214d35700 Added query expires at 1681287498 (POSITIVE) openldap-cache_1 | 64366940.0868bf3d 0x7fa214d35700 Lock AQ index = 0x5572682fda70 openldap-cache_1 | 64366940.0868cc0d 0x7fa214d35700 TEMPLATE 0x5572682fda70 QUERIES++ 1 openldap-cache_1 | 64366940.0868d3eb 0x7fa214d35700 Base of added query = ou=Domains,dc=openldap,dc=example openldap-cache_1 | 64366940.0868daa0 0x7fa214d35700 Unlock AQ index = 0x5572682fda70 openldap-cache_1 | 64366940.0868f2f2 0x7fa214d35700 UUID for query being added = 4d0928a8-6d56-103d-8d96-0b2b6342ea75 openldap-cache_1 | 64366940.092158fe 0x7fa214d35700 ENTRY ADDED/MERGED, CACHED ENTRIES=1 openldap-cache_1 | 64366940.09219238 0x7fa214d35700 STORED QUERIES = 1 openldap-cache_1 | 64366940.0921a8d6 0x7fa214d35700 conn=1007 op=1 SEARCH RESULT tag=101 err=0 qtime=0.000014 etime=0.013522 nentries=1 text= If I run slapd with all Debug Logging enabled ( slapd ... -d -1 ...) I see, the DirX backend **do answer** with the expexted date but the log is so verbose, so I could not see a problem. using ldapsearch directly against both backend servers I verified, the requested data are accessible. One glitch I found in the Documentation at https://www.openldap.org/doc/admin26/guide.html#The%20Proxy%20Cache%20Engine Under "12.9.2.4. Example for slapd.conf" the is an Entry "cachesize 20" mentioned. If I enable this option, slapd fail to start: openldap-cache_1 | 64366b51.0ec4f7d9 0x7f4f046423c0 /usr/local/etc/openldap/slapd.conf: line 45 (cachesize 20) openldap-cache_1 | 64366b51.0ec5f70a 0x7f4f046423c0 /usr/local/etc/openldap/slapd.conf: line 45: unknown directive <cachesize> inside backend database definition. Is the documentation really correct? Andreas

2 2

Argon2-Support or secure hashing
by Lukas Adrian Kron 13 Apr '23

13 Apr '23

Hello, I am trying to use Argon2 or PBKDF2_SHA256 as a secure password hashing function. Since two weeks I am trying to get this to work with reading a lot of information on the internet and I just cannot get it to work. I am using Ubuntu 20.04 LTS, installed with slapd, ldap-utils, argon2 and trying to set it in the cn=config Frontend setting. @(#) $OpenLDAP: slapd (Ubuntu) (May 12 2022 13:11:05) $ Debian OpenLDAP Maintainers <pkg-openldap-devel(a)lists.alioth.debian.org> This is the version that is installed from Slapd and when I try to set pw-argon2, {ARGON2}, pw-argon2.so... I tried a lot and it tells me no hash found. If I try {MD5} it works without problems. As there is no other secure usable password hashing installed the LDAP Server is right now insecure and I cannot move it to production Please does someone has any idea? Many kind regards, Lukas

2 1

meaning of bind_ssf
by Stefan Kania 13 Apr '23

13 Apr '23

Hi to all, when I connect to openldap, with simple-bind I see: ----------- mech=SIMPLE bind_ssf=0 ssf=256 ----------- When I connect to openldap with GSSAPI I see: ----------- mech=GSSAPI bind_ssf=56 ssf=256 ----------- So I uses strong-bind via GSSAPI there is no place where I can find anything about "bind_ssf". So what ist bind_ssf stands for? I only found: transport_ssf=<n> tls_ssf=<n> sasl_ssf=<n> Another strange thing (to me ;-) ) The openldap admin guide is telling me: ---------------- The server uses Security Strength Factors (SSF) to indicate the relative strength of protection. A SSF of zero (0) indicates no protections are in place. A SSF of one (1) indicates integrity protection are in place. A SSF greater than one (>1) roughly correlates to the effective encryption key length. For example, DES is 56, 3DES is 112, and AES 128, 192, or 256. ---------------- in my kdc.conf I have: --------------- supported_enctypes = aes256-cts-hmac-sha1-96:normal aes128-cts-hmac-sha1-96:normal --------------- So no DES with a key-length of 56 is defined. Same when I look at the key from my user I'm using to connect. The infos about the user is telling me in kadmin ---------------- Key: vno 1, aes256-cts-hmac-sha1-96 Key: vno 1, aes128-cts-hmac-sha1-96 ---------------- So why is the log telling me ssf=56? Stefan

2 3

Slow Search?
by Bradley T Gill 12 Apr '23

12 Apr '23

I have an ou with 3.2M users. Doing a simple search of 1 attribute with a scope of 1 and a base of that flat ou is taking 6.2 Seconds. In a replica database, I have attempted to remove all other indexes but the attribute I am searching for and it still is taking over 6 seconds. Is that to be expected? Apr 11 10:37:49 slapd[25081]: conn=1000 op=20 SRCH base="ou=FlatOU" scope=1 deref=3 filter="(attr=login102)" Apr 11 10:37:49 slapd[25081]: conn=1000 op=20 SRCH attr=objectClass Apr 11 10:37:55 slapd[25081]: conn=1000 op=20 SEARCH RESULT tag=101 err=0 qtime=0.000025 etime=6.267130 nentries=1 text= Only Idex: olcDbIndex: attr pres,eq After settting the index, I stopped ldap and ran slapindex CPU: Architecture: x86_64 CPU op-mode(s): 32-bit, 64-bit Byte Order: Little Endian CPU(s): 8 On-line CPU(s) list: 0-7 Thread(s) per core: 1 Core(s) per socket: 1 Socket(s): 8 NUMA node(s): 1 Vendor ID: GenuineIntel CPU family: 6 Model: 85 Model name: Intel(R) Xeon(R) Gold 6136 CPU @ 3.00GHz Stepping: 0 CPU MHz: 2992.968 BogoMIPS: 5985.93 Hypervisor vendor: VMware Virtualization type: full L1d cache: 32K L1i cache: 32K L2 cache: 1024K L3 cache: 25344K NUMA node0 CPU(s): 0-7 Flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ss syscall nx pdpe1gb rdtscp lm constant_tsc arch_perfmon nopl xtopology tsc_reliable nonstop_tsc eagerfpu pni pclmulqdq ssse3 fma cx16 pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand hypervisor lahf_lm abm 3dnowprefetch invpcid_single ssbd rsb_ctxsw ibrs ibpb stibp fsgsbase tsc_adjust bmi1 avx2 smep bmi2 invpcid avx512f avx512dq rdseed adx smap clflushopt clwb avx512cd avx512bw avx512vl xsaveopt xsavec arat pku ospke md_clear spec_ctrl intel_stibp flush_l1d arch_capabilities 24 GB of RAM with 10 GB Free Thanks for any suggestions: Bradley Gill

3 5

slapadd: bad configuration directory!
by cxb2000abc＠gmail.com 06 Apr '23

06 Apr '23

Hi all, I am new to OpenLDAP, recently I am following the official quick-start guide and finished the installation part. However when configuring the database which is step 9 in the guide su root -c /usr/local/sbin/slapadd -n 0 -F /usr/local/etc/slapd.d -l /usr/local/etc/openldap/slapd.ldif I got the error: slapadd: bad configuration directory! I look into the folder /usr/local/etc/, I don't see any slapd.d. Even I saw some discussion say that it located at /etc/openldap/. I can't see any either. Please help me out. Thank you very much.

3 2

How to build argon2.so ?
by Scott Classen 06 Apr '23

06 Apr '23

Hello, According to: servers/slapd/pwmods/README.argon2 Building -------- 1) Customize the OPENLDAP variable in Makefile to point to the OpenLDAP source root. For initial testing you might also want to edit DEFS to define SLAPD_ARGON2_DEBUG, which enables logging to stderr (don't leave this on in production, as it prints passwords in cleartext). 2) Run 'make' to produce argon2.so 3) Copy argon2.so somewhere permanent. 4) Edit your slapd.conf (eg. /etc/ldap/slapd.conf), and add: moduleload ...path/to/argon2.so 5) Restart slapd. When I run make from within servers/slapd/pwmods/ I get the following error: [user@machine openldap-2.6.4]# cd servers/slapd/pwmods/ [user@machine pwmods]# make make: *** No rule to make target 'dummyvalue', needed by 'all-common'. Stop. I’m not sure what “dummyvalue” is supposed to be so I commented out line 288 in servers/slapd/pwmods/Makefile # LIBRARY = dummyvalue And get this error: [user@ machine pwmods]# make /bin/sh ../../../libtool --tag=disable-static --mode=compile cc -g -O2 -I../../../include -I../../../include -I.. -I./.. -DSLAPD_IMPORT -c version.c libtool: compile: cc -g -O2 -I../../../include -I../../../include -I.. -I./.. -DSLAPD_IMPORT -c version.c -fPIC -DPIC -o .libs/version.o version.c:1:6: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘:’ token usage: mkversion [-c] [-s] [-p package] [-v version] application ^ make: *** [Makefile:310: version.lo] Error 1 Any help in generating argon2.so would be greatly appreciated. If I’m somehow getting deeper in the weeds than I need to with the new OpenLDAP version 2.6.4 in order to support {ARGON2} hashes please let me know. Import of my slapd.ldif file is bonking on: olcPasswordHash: {ARGON2} So as with previous versions of OpenLDAP I assumed I would need to build and load the argon2 module manually. Sincerely, Scott Classen

2 2

slapd broken w/ppolicy
by Paulo Ricardo Bruck 05 Apr '23

05 Apr '23

Hi All Using : Ubuntu 22.04 slapd 2.5.14+dfsg-0ubuntu0.22.04.1 amd64 policy: # module{0}, config dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_mdb olcModuleLoad: {1}memberof olcModuleLoad: {2}refint olcModuleLoad: {3}ppolicy # {2}ppolicy, {1}mdb, config dn: olcOverlay={2}ppolicy,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: {2}ppolicy olcPPolicyDefault: cn=default_policies,ou=policies,dc=contatogs,dc=com,dc=br olcPPolicyHashCleartext: TRUE olcPPolicyUseLockout: FALSE olcPPolicyForwardUpdates: FALSE # contatogs-ppolicy, Policies, contatogs.com.br dn: cn=contatogs-ppolicy,ou=Policies,dc=contatogs,dc=com,dc=br objectClass: top objectClass: person objectClass: pwdPolicy cn: contatogs-ppolicy sn: policies pwdAttribute: userPassword pwdMinAge: 0 pwdInHistory: 6 pwdCheckQuality: 2 pwdMinLength: 8 pwdLockout: TRUE pwdLockoutDuration: 1800 pwdMaxFailure: 3 pwdFailureCountInterval: 1800 pwdAllowUserChange: TRUE pwdMaxRecordedFailure: 3 Using a simple ldapsearch with correct user and password works fine. xxx is the correct password root@zeus:/usr/lib/python3/dist-packages# ldapsearch -xLLLZZD uid=pauloric,ou=users,dc=contatogs,dc=com,dc=br -w xxx |wc -l 10725 Using wrong password : (yyy) root@zeus:/usr/lib/python3/dist-packages# ldapsearch -xLLLZZD uid=pauloric,ou=users,dc=contatogs,dc=com,dc=br -w yyy |wc -l ldap_bind: Invalid credentials (49) 0 So far so good but if I insert : pwdMaxDelay: 40 pwdMinDelay: 4 test with correct password is ok ( xxx) root@zeus:/usr/lib/python3/dist-packages# ldapsearch -xLLLZZD uid=pauloric,ou=users,dc=contatogs,dc=com,dc=br -w xxx |wc -l 10725 But if I test with a wrong password ( yyy) I got: root@zeus:/usr/lib/python3/dist-packages# ldapsearch -xLLLZZD uid=pauloric,ou=users,dc=contatogs,dc=com,dc=br -w yyy |wc -l ldap_result: Can't contact LDAP server (-1) 0 my openldap stop working.........Active: inactive (dead) root@zeus:/usr/lib/python3/dist-packages# systemctl status -l slapd ○ slapd.service - LSB: OpenLDAP standalone server (Lightweight Director> Loaded: loaded (/etc/init.d/slapd; generated) Drop-In: /usr/lib/systemd/system/slapd.service.d └─slapd-remain-after-exit.conf Active: inactive (dead) since Tue 2023-04-04 14:44:49 -03; 20s ago Docs: man:systemd-sysv-generator(8) Process: 986673 ExecStart=/etc/init.d/slapd start (code=exited, sta> Process: 986688 ExecStop=/etc/init.d/slapd stop (code=exited, statu> CPU: 47ms Apr 04 14:44:46 zeus slapd[986679]: auxpropfunc error invalid parameter> Apr 04 14:44:46 zeus slapd[986679]: _sasl_plugin_load failed on sasl_au> Apr 04 14:44:46 zeus slapd[986679]: ldapdb_canonuser_plug_init() failed> Apr 04 14:44:46 zeus slapd[986679]: _sasl_plugin_load failed on sasl_ca> Apr 04 14:44:46 zeus slapd[986680]: slapd starting Apr 04 14:44:46 zeus slapd[986673]: ...done. Apr 04 14:44:46 zeus systemd[1]: Started LSB: OpenLDAP standalone serve> Apr 04 14:44:49 zeus slapd[986688]: * Stopping OpenLDAP slapd Apr 04 14:44:49 zeus slapd[986688]: ...done. Apr 04 14:44:49 zeus systemd[1]: slapd.service: Deactivated successfull What am I doing wrong???? Cheers -- Paulo Ricardo Bruck consultor

3 2

.so dynamic library versioning
by Sam Dave 04 Apr '23

04 Apr '23

Hello, Thanks in advance for some clues on the below: 1. Has there ever been a release of LMDB that adds/removes/changes API? 2. On both Debian 10 (with lmdb 0.9.22) and Debian 11 (with lmdb 0.9.24) , under lib/ I see liblmdb.so -> liblmdb.so.0 (symlink) liblmdb.so.0 -> liblmdb.so.0.0.0 (symlink) liblmdb.so.0.0.0 (the original file) Has this always been at 0.0.0 since the beginning of LMDB? From the point of view of what the LMDB developers would expect, I mean. (I have no idea which distros were distributing LMDB in the early days) 3. What are your intentions regarding this .so versioning in relation to adding/removing/changes to the API? Something like this, perhaps? https://www.gnu.org/software/libtool/manual/html_node/Updating-version-info… 4. Another Linux distribution (NixOS 22.11, with lmdb 0.9.29) has *only* this under lib/: liblmdb.so (the original file) Does this sound right to you? What I mean is, when people compile LMDB down to an .so, would you expect them to normally add a version after the ".so"? (As they apparently did in Debian) Regards, Sam

2 2

Re: Uninstall
by Eric Fetzer 03 Apr '23

03 Apr '23

OK, so how do I uninstall what I have installed now? On Fri, Mar 31, 2023 at 9:15 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Friday, March 31, 2023 4:03 PM -0600 Eric Fetzer > <eric.fetzer(a)gmail.com> wrote: > > > > > From what I read, there are no repositories for RHEL 8.7. They were > > there for RHEL 7 but not 8. I read this in several places including > > here: > > > > > > > https://medium.com/@fengliplatform/setup-openldap-2-6-server-on-rhel-8-4- > > d8640b7fa22 > > > > > > > > Am I wrong? > > Yes. > > <https://repo.symas.com/> > > or > > <https://ltb-project.org/download.html> > > --Quanah > > > > >

2 2

Configuring LDAP in a pure-UNIX environment...
by Marco Gaiarin 02 Apr '23

02 Apr '23

I use OpenLDAP by years, but binded to Samba and using for the user management mostly Samba-aware tools (LAM and smbldap-tools) and using Samba account policy. Now i need to setup a 'pure' UNIX environment, in a debian box; i've enabled shadow data in account, but found that some very simple things (like locking an account, AKA 'passwd -l') simply does not work. Also there's no info if an account is locked (eg, password start with '!'), because the info is 'embedded' on the same password data, and so (and obviously) protected. Most of these things are not OpenLDAP fault, but really i dont't know how to ask for elsewhere... But there's some way to get around some limitation? EG, there's some way (via an overlay?) to ''compute'' the field 'shadowLocked = yes' if userPassword start with an '!', end expose that via an ACL? I've tried to search for some examples, but found nothing. Thanks. -- ...e andate chissa` dove per non pagar le tasse col ghigno e l'ignoranza dei primi della classe. (F. Guccini)

1 0

back_meta and overlay pcache
by Stefan Kania 01 Apr '23

01 Apr '23

Hello, I try to configure a proxy-server with back_meta connecting to to different AD-domains. I'm getting the result as expected if I do an ldapsearch. But now I want to add caching for the data, so I configured the following: ---------------- dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/symas/run/slapd.args olcLogLevel: any olcPidFile: /var/symas/run/slapd.pid olcToolThreads: 1 dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /opt/symas/lib/openldap olcModuleLoad: {0}back_ldap olcModuleLoad: {1}back_meta olcModuleLoad: {2}argon2 olcModuleLoad: {3}rwm.la olcModuleLoad: {4}pcache.la olcModuleLoad: {5}back_mdb.la dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema ... ... dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by * read olcSizeLimit: 500 olcPasswordHash: {ARGON2} dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage olcRootDN: cn=admin,cn=config olcRootPW: {ARGON2}$argon2i$v=19$m=4096,t=3,p=1$cXdlcnJ0enV6dWlvMTIz$G/l0lynf7 ygdz0tG+E7S1fBibsFs/L80AUSisiGl/v4 dn: olcDatabase={1}meta,cn=config objectClass: olcDatabaseConfig objectClass: olcMetaConfig olcDatabase: {1}meta olcSuffix: dc=example,dc=net olcReadOnly: TRUE olcRootDN: cn=admin,dc=example,dc=net olcRootPW: $argon2i$v=19$m=4096,t=3,p=1$c2dkc3Rld3Z0ZTV0NDU0NQ$F6NZb2w8O+6BOA3 L7zZ37mxFv7CPCXfHYuEiIxTYALY olcMonitoring: FALSE olcDbChaseReferrals: FALSE olcDbProtocolVersion: 3 olcDbRebindAsUser: TRUE dn: olcOverlay={0}rwm,olcDatabase={1}meta,cn=config objectClass: olcOverlayConfig objectClass: olcRwmConfig olcOverlay: {0}rwm olcRwmTFSupport: false olcRwmMap: {0}objectClass posixAccount person olcRwmMap: {1}attribute uid sAMAccountName dn: olcOverlay={1}pcache,olcDatabase={1}meta,cn=config objectClass: olcOverlayConfig objectClass: olcPcacheConfig olcOverlay: {1}pcache olcPcache: mdb 100000 2 1000 100 olcPcacheAttrset: 0 mail postalAddress telephoneNumber givenName olcPcacheAttrset: 1 uid employeeType olcPcacheTemplate: "(&(mail=)(postalAddress=*)(telephoneNumber)" 0 3600 100 3 0 1600 olcPcacheTemplate: "(&(sn=)(givenName=))" 0 3600 100 olcPcacheTemplate: "(mail=)" 0 3600 olcPcacheTemplate: "(sn=)" 1 3600 100 olcPcacheTemplate: "(uid=)" 1 3600 1000 30 200 olcPcachePersist: TRUE dn: olcDatabase={0}mdb,olcOverlay={1}pcache,olcDatabase={1}meta,cn=config objectClass: olcMdbConfig objectClass: olcPcacheDatabase olcDatabase: {0}mdb olcDbDirectory: /var/symas/pcache olcDbIndex: objectClass eq olcDbIndex: uid,employeeType,mail eq olcDbIndex: postalAddress,telephoneNumber,givenName eq dn: olcMetaSub={0}uri,olcDatabase={1}meta,cn=config objectClass: olcMetaTargetConfig olcMetaSub: {0}uri olcDbURI: "ldap://192.168.56.202/ou=org,dc=example,dc=net" olcDbIDAssertAuthzFrom: {0}* olcDbIDAssertBind: mode=none flags=prescriptive,proxy-authz-non-critical bindm ethod=simple timeout=0 network-timeout=0 binddn="cn=proxy-orguser,cn=users,dc =example2,dc=org" credentials="Passw0rd" keepalive=0:0:0 tcp-user-timeout=0 tls_reqcert=never tls_reqsan=allow tls_crlcheck=none olcDbMap: {0}attribute uid sAMAccountName olcDbRewrite: {0}suffixmassage "ou=org,dc=example,dc=net" "dc=example2,dc=org" olcDbKeepalive: 0:0:0 olcDbChaseReferrals: FALSE olcDbProtocolVersion: 3 olcDbRebindAsUser: TRUE dn: olcMetaSub={1}uri,olcDatabase={1}meta,cn=config objectClass: olcMetaTargetConfig olcMetaSub: {1}uri olcDbURI: "ldap://192.168.56.203/ou=com,dc=example,dc=net" olcDbIDAssertAuthzFrom: {0}* olcDbIDAssertBind: mode=none flags=prescriptive,proxy-authz-non-critical bindm ethod=simple timeout=0 network-timeout=0 binddn="cn=proxy-comuser,cn=users,dc =example3,dc=com" credentials="Passw0rd" keepalive=0:0:0 tcp-user-timeout=0 t ls_reqcert=never tls_reqsan=allow tls_crlcheck=none olcDbMap: {0}attribute uid sAMAccountName olcDbRewrite: {0}suffixmassage "ou=com,dc=example,dc=net" "dc=example3,dc=com" olcDbKeepalive: 0:0:0 olcDbChaseReferrals: FALSE olcDbProtocolVersion: 3 olcDbRebindAsUser: TRUE ---------------- The same pcache setup works with back_ldap. What did I do wrong or did I miss something. Using this setting with back_ldap, doing a ledapsearch, stopping the domaincontroller, repeat the ldapserch, because the data is in cache I still get the result. Seting up back_meta, as soon as I stop the domaincontroller I got nothing at all. Do I have to set up a cache for every uri? Then what should be the DN? Stefan

1 2

Uninstall
by Eric Fetzer 01 Apr '23

01 Apr '23

OK, getting a little further. I've come to the realization that I need to uninstall, reconfigure to include a few overlays, then reinstall. I'm on RHEL 8.7, and thus built from source. What do I need to do to uninstall? Guessing the first thing I need to remove is /etc/openldap. Thanks, Eric

3 5

Re: Adding to the schema
by Eric Fetzer 30 Mar '23

30 Mar '23

So I'm still on this. Since I'm running cn=config rather than slapd.conf, I'm confused as to where to put the: overlay ppolicy I don't have a: database mdb Here's my slapd.ldif that I loaded in (with the added olcModuleload you told me to add): dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/lib/openldap/slapd.args olcPidFile: /var/lib/openldap/slapd.pid dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulepath: /usr/libexec/openldap olcModuleload: back_mdb.la olcModuleload ppolicy.so # Include more schemas in addition to default core include: file:///etc/openldap/schema/core.ldif include: file:///etc/openldap/schema/cosine.ldif include: file:///etc/openldap/schema/nis.ldif include: file:///etc/openldap/schema/inetorgperson.ldif include: file:///etc/openldap/schema/sudo.ldif dn: olcDatabase=frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: frontend olcAccess: to dn.base="cn=Subschema" by * read olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none dn: olcDatabase=config,cn=config objectClass: olcDatabaseConfig olcDatabase: config olcRootDN: cn=config olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none So where would I put the: overlay ppolicy Thanks, Eric On Tue, Mar 7, 2023 at 12:21 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Tuesday, March 7, 2023 12:16 PM -0700 Eric Fetzer > <eric.fetzer(a)gmail.com> wrote: > > > > > I'm using 2.6.4. Sorry, brand new at this, how do I enable it? I > > don't see any references to it in the slapd.conf... I'm in the process > > of converting an ISDS db to OpenLDAP. Kind of daunting so far... > > > Generally speaking: > > In the portion of your configuration loading module: > > modulepath .... > moduleload ppolicy.so > > > In the database section of your configuration where you want to apply > password policies > > > database mdb > ... > > overlay ppolicy > > > Regards, > Quanah > > >

2 1

Up To Date Documentation
by Eric Fetzer 30 Mar '23

30 Mar '23

Where can I go for documentation on modern versions of OpenLDAP? I've been reading the guide at https://www.zytrax.com/books/ldap/ch1/ but it appears to be out of date from what I'm finding when trying to use it. Thanks, Eric

2 1

olcDbCacheSize in back_mdb
by Stefan Kania 29 Mar '23

29 Mar '23

Looking at the openldap.org adminhandbook to 2.6 I found https://openldap.org/doc/admin26/overlays.html#The%20Proxy%20Cache%20Engine The configuration for the databas for pcache: ------------ dn: olcDatabase={0}mdb,olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config objectClass: olcMdbConfig objectClass: olcPcacheDatabase olcDatabase: {0}mdb olcDbDirectory: ./testrun/db.2.a olcDbCacheSize: 20 olcDbIndex: objectClass eq olcDbIndex: cn,sn,uid,mail pres,eq,sub ------------ But I'm getting: ------------- adding new entry "olcDatabase={0}mdb,olcOverlay={1}pcache,olcDatabase={1}ldap,cn=config" ldap_add: Undefined attribute type (17) additional info: olcDbCacheSize: attribute type undefined ------------- The back_mdb module is loaded. -- Here my config "WITHOUT" olcDbCacheSize: ---------------- dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/symas/run/slapd.args olcLogLevel: any olcPidFile: /var/symas/run/slapd.pid olcToolThreads: 1 dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /opt/symas/lib/openldap olcModuleLoad: {0}back_ldap olcModuleLoad: {1}argon2 olcModuleLoad: {2}rwm.la olcModuleLoad: {3}pcache.la olcModuleLoad: {4}back_mdb.la dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema ... dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by * read olcSizeLimit: 500 olcPasswordHash: {ARGON2} dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage olcRootDN: cn=admin,cn=config olcRootPW: {ARGON2}$argon2i$v=19$m=4096,t=3,p=1$cXdlcnJ0enV6dWlvMTIz$G/l0lynf7 ygdz0tG+E7S1fBibsFs/L80AUSisiGl/v4 dn: olcDatabase={1}ldap,cn=config objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {1}ldap olcSuffix: dc=example1,dc=net olcReadOnly: TRUE olcRootDN: cn=admin,dc=example1,dc=net olcMonitoring: FALSE olcDbURI: "ldaps://dc-net01.example.net:636" olcDbIDAssertBind: mode=none flags=prescriptive,proxy-authz-critical bindmeth od=simple timeout=0 network-timeout=0 binddn="cn=proxy-user,cn=users,dc=examp le1,dc=net" credentials="Passw0rd" keepalive=0:0:0 tls_reqcert=never tls_reqs an=allow olcDbIDAssertAuthzFrom: {0}* olcDbRebindAsUser: TRUE olcDbChaseReferrals: FALSE olcDbProtocolVersion: 3 dn: olcOverlay={0}rwm,olcDatabase={1}ldap,cn=config objectClass: olcOverlayConfig objectClass: olcRwmConfig olcOverlay: {0}rwm olcRwmTFSupport: false olcRwmMap: {0}objectClass posixAccount person olcRwmMap: {1}attribute uid SAMACCOUNTNAME olcRwmMap: {2}attribute EMPLOYEETYP DEPARTMENT dn: olcOverlay={1}pcache,olcDatabase={1}ldap,cn=config objectClass: olcOverlayConfig objectClass: olcPcacheConfig olcOverlay: {1}pcache olcPcache: mdb 100000 1 1000 100 olcPcacheAttrset: 0 mail postalAddress telephoneNumber olcPcacheTemplate: "(sn=)" 0 3600 0 0 0 olcPcacheTemplate: "(&(sn=)(givenName=))" 0 3600 0 0 0 olcPcacheTemplate: "(&(departmentNumber=)(secretary=))" 0 3600 olcPcachePersist: TRUE dn: olcDatabase={0}mdb,olcOverlay={1}pcache,olcDatabase={1}ldap,cn=config objectClass: olcMdbConfig objectClass: olcPcacheDatabase olcDatabase: {0}mdb olcDbDirectory: /var/symas/pcache olcDbIndex: objectClass eq olcDbIndex: uid eq ---------------- Did I miss someting or is it wrong in the adminbook?

2 1

Are there plans to support OpenSSL 3.0.x in OpenLDAP v2.5?
by Soichiro Shishido 28 Mar '23

28 Mar '23

Are there plans to support OpenSSL 3.0.x in OpenLDAP v2.5? OpenSSL 1.1.1 will be discontinued this year on 2023-09-11. Also, according to the OpenLDAP Project Release Maintenance Policy, it appears that v2.6 will not be LTS for some time yet. If OpenSSL 1.1.1 vulnerabilities are reported after 2023-09-12, and if we do not migrate to OpenSSL 3.0.x, OpenLDAP v2.5 will be left vulnerable.

2 2

overlay pcache and cn=config
by Stefan Kania 27 Mar '23

27 Mar '23

Hello, I've got the following working slapd.conf: -------------------- include /opt/symas/etc/openldap/schema/core.schema include /opt/symas/etc/openldap/schema/cosine.schema include /opt/symas/etc/openldap/schema/inetorgperson.schema include /opt/symas/etc/openldap/schema/misc.schema include /opt/symas/etc/openldap/schema/nis.schema include /opt/symas/etc/openldap/schema/msuser.schema modulepath /opt/symas/lib/openldap moduleload back_ldap moduleload back_mdb moduleload rwm.la moduleload memberof.la moduleload pcache.la loglevel any pidfile /var/symas/run/slapd.pid argsfile /var/symas/run/slapd.args database ldap readonly yes protocol-version 3 rebind-as-user yes uri "ldap://192.168.56.201:389" suffix "dc=example1,dc=net" rootdn "cn=admin,dc=example1,dc=net" idassert-bind bindmethod=simple mode=none binddn="CN=Administrator,cn=users,dc=example1,dc=net" credentials=Passw0rd tls_cacertdir=/opt/symas/etc/openldap tls_reqcert=never idassert-authzFrom "*" overlay rwm rwm-map attribute uid sAMAccountName rwm-map objectClass posixAccount person overlay memberof memberof-group-oc groupOfuniqueNames memberof-member-ad uniquemember memberof-dangling error overlay pcache pcache mdb 100000 6 1000 100 pcachePersist TRUE directory "/var/symas/pcache" pcacheAttrset 0 1.1 pcacheTemplate (uid=) 0 3600 pcacheTemplate (&(|(objectClass=))) 0 3600 pcacheAttrset 1 employeetype givenName cn sn uid mail pcacheTemplate (uid=) 1 3600 pcacheBind (uid=) 1 3600 sub dc=de pcacheAttrset 2 givenName cn sn uid mail uidNumber pcacheTemplate (objectClass=) 2 3600 pcacheAttrset 3 userPassword pcacheTemplate (uid=) 3 3600 pcacheTemplate (objectClass=) 2 3600 pcacheAttrset 4 employeetype givenName cn sn uid mail pcacheTemplate (uid=) 1 3600 pcacheAttrset 5 memberOf pcacheTemplate (objectClass=*) 2 3600 -------------------- Search for an entry in AD is working: ---------------------- root@ldap-proxy01:~/server-setup/proxy# ldapsearch -x -b dc=example1,dc=net cn=administrator -LLL dn dn: cn=Administrator,cn=Users,dc=example1,dc=net ---------------------- Now I want to convert it to cn=config but Im getting the following error: -------------------- root@ldap-proxy01:/opt/symas/etc/openldap# slaptest -F ./my-slapd.d/ -f slapd.conf Entry (olcDatabase={0}mdb,olcOverlay={2}pcache,olcDatabase={1}ldap,cn=config): object class 'olcMdbBkConfig' requires attribute 'olcBackend' config_build_entry: build "olcDatabase={0}mdb" failed: "(null)" config file testing succeeded mdb_opinfo_get: err Permission denied(13) -------------------- Then I try to create my own LDIFs: basic config: ----------------- dn: cn=config objectClass: olcGlobal cn: config olcLogLevel: any olcPidFile: /var/symas/run/slapd.pid olcArgsFile: /var/symas/run/slapd.args olcToolThreads: 1 dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /opt/symas/lib/openldap olcModuleLoad: back_mdb olcModuleLoad: back_ldap olcModuleLoad: back_monitor olcModuleLoad: argon2 include: file:///opt/symas/etc/openldap/schema/core.ldif include: file:///opt/symas/etc/openldap/schema/cosine.ldif include: file:///opt/symas/etc/openldap/schema/nis.ldif include: file:///opt/symas/etc/openldap/schema/inetorgperson.ldif include: file:///opt/symas/etc/openldap/schema/msuser.ldif dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcSizeLimit: 500 olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break olcAccess: {1}to dn="" by * read olcAccess: {2}to dn.base="cn=subschema" by * read dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootDN: cn=admin,cn=config olcRootPW: {ARGON2}$argon2i$v=19$m=4096,t=3,p=1$cXdlcnJ0enV6dWlvMTIz$G/l0lynf7ygdz0tG+E7S1fBibsFs/L80AUSisiGl/v4 olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage dn: olcDatabase={1}monitor,cn=config objectClass: olcDatabaseConfig olcDatabase: {1}monitor olcAccess: {0}to dn.subtree="cn=monitor" by dn.exact=cn=admin,cn=config read by dn.exact=cn=admin,dc=example,dc=net read by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth read dn: olcDatabase={2}ldap,cn=config objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {2}ldap olcSuffix: dc=example1,dc=net olcAddContentAcl: FALSE olcLastMod: FALSE olcLastBind: FALSE olcLastBindPrecision: 0 olcMaxDerefDepth: 15 olcReadOnly: TRUE olcRootDN: cn=admin,dc=example1,dc=net olcSyncUseSubentry: FALSE olcMonitoring: FALSE olcDbURI: "ldap://dc-net01.example.net:389" olcDbStartTLS: none starttls=no olcDbIDAssertBind: mode=none flags=prescriptive,proxy-authz-non-critical bindm ethod=simple timeout=0 network-timeout=0 binddn="cn=administrator,cn=users,dc =example1,dc=net" credentials="Passw0rd" keepalive=0:0:0 tcp-user-timeout=0 t ls_cacertdir="/opt/symas/etc/openldap" tls_reqcert=never tls_reqsan=allow tls _crlcheck=none olcDbIDAssertAuthzFrom: * olcDbRebindAsUser: TRUE olcDbChaseReferrals: FALSE olcDbTFSupport: no olcDbProxyWhoAmI: FALSE olcDbProtocolVersion: 3 olcDbSingleConn: FALSE olcDbCancel: abandon olcDbUseTemporaryConn: FALSE olcDbConnectionPoolMax: 16 olcDbSessionTrackingRequest: FALSE olcDbNoRefs: FALSE olcDbNoUndefFilter: FALSE olcDbOnErr: continue olcDbKeepalive: 0:0:0 ----------------- LDIF for rwm ------------------ dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: rwm.la dn: olcOverlay={0}rwm,olcDatabase={2}ldap,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcRwmConfig olcOverlay: {0}rwm olcRwmTFSupport: false olcRwmMap: {0}objectClass posixAccount person olcRwmMap: {1}attribute uid sAMAccountName ------------------ LDIF for pcache ------------------ dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: pcache.la dn: olcOverlay={3}pcache,olcDatabase={2}ldap,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcPcacheConfig olcOverlay: {3}pcache olcPcache: mdb 100000 5 1000 100 olcPcacheAttrset: 0 employeeType givenName cn sn uid mail olcPcacheAttrset: 1 givenName cn sn uid mail uidNumber olcPcacheAttrset: 2 userPassword olcPcacheAttrset: 3 employeeType givenName cn sn uid mail olcPcacheAttrset: 4 memberOf olcPcacheTemplate: "(objectClass=*)" 2 3600 0 0 0 olcPcacheTemplate: (&(objectClass=)(memberUid=)) 2 300 olcPcacheTemplate: (&(objectClass=)(uid=)) 0 300 dn: olcDatabase=mdb,olcOverlay={3}pcache,olcDatabase={2}ldap,cn=config changetype: add objectClass: olcMdbConfig objectClass: olcPcacheDatabase olcDbDirectory: /var/symas/pcache olcDbIndex: pcacheQueryID eq ------------------ But wenn I do a ldapsearch I got the following result: ---------------- root@ldap-proxy01:~/server-setup/proxy# ldapsearch -x -b dc=example1,dc=net cn=administrator -LLL dn # refldap://example1.net/CN=Configuration,DC=example1,DC=net # refldap://example1.net/DC=DomainDnsZones,DC=example1,DC=net # refldap://example1.net/DC=ForestDnsZones,DC=example1,DC=net ---------------- I only got the Referrals from AD, but not the object I'm looking for. It's nearly impossible to find a good documentation on how to setup pcache overlay via cn=config. As i said with slapd.conf everyting works. Any hint that get things working as expected? When I'm starting the slapd the log is showing: ----------- mdb_db_open: database "dc=example1,dc=net": dbenv_open(/var/symas/pcache). ----------- Same Server different problem I did not add memberof, because everytime I add the overlay with the following LDIF (should be replaced by dynlist in the near future) But I think it should work: -------------- dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: memberof.la dn: olcOverlay={1}memberof,olcDatabase={2}ldap,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcMemberOfConfig olcOverlay: {1}memberof olcMemberOfGroupOC: groupOfNames olcMemberOfMemberAD: member -------------- The slapd chrashes and "slapcat -n0" is giving e the following error: --------------- root@ldap-proxy01:~/server-setup/proxy# slapcat -n0 olcAttributeTypes: value #741 olcAttributeTypes: Duplicate attributeType: " z*V" config error processing cn={4}msuser,cn=schema,cn=config: olcAttributeTypes: Duplicate attributeType: " z*V" slapcat: bad configuration file! ---------------

2 2

question about manpage slapo-dynlist
by Stefan Kania 26 Mar '23

26 Mar '23

Hi to all, the manpage of the slapo-dynlist is showing the following example: ----------- A dynamic group with dgIdentity authorization could be created with an entry like dn: cn=Dynamic Group,ou=Groups,dc=example,dc=com objectClass: groupOfURLs objectClass: dgIdentityAux cn: Dynamic Group memberURL: ldap:///ou=People,dc=example,dc=com??sub?(objectClass=person) dgIdentity: cn=Group Proxy,ou=Services,dc=example,dc=com ----------- I can't find an explanation of the attribute "dgIdentity", it's not mentioned what is "cn=Group Proxy,ou=Services,dc=example,dc=com". Can someone explain it please. Stefan

2 1

Re: Adding to the schema
by Eric Fetzer 20 Mar '23

20 Mar '23

How do I enable this overlay if I'm using slapd-config? Sorry, I've been reading all of the Zytrex documentation, but it's going right over my head. Especially the slapd-config stuff... On Tue, Mar 7, 2023 at 12:10 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Monday, March 6, 2023 11:23 AM -0700 Eric Fetzer > <eric.fetzer(a)gmail.com> wrote: > > > > > Hi All, > > > > > > I need to add to my schema on my freshly built server. > > If you're using OpenLDAP 2.5 or later, the ppolicy schema is built into > the > ppolicy overlay and you should not be loading it separately at all. I > would note that all releases prior to OpenLDAP 2.5 are historic and not > supported. > > Regards, > Quanah > > > >

1 0

After update slapd 2.5.13->2.5.14, dynlist memberOf not working anymore
by Andreas Ladanyi 20 Mar '23

20 Mar '23

Hi, after upgrade from 2.5.13->2.5.14 i cant get any search result from slapd when filtering for specific memberOf=value. If i downgrade back to slapd 2.5.13 all is working again. It doesnt work with ldapsearch nor with sssd-ldap modul when filtering entities with a specific memberOf=Value: ldapsearch -o ldif-wrap=no -LLL -x -ZZ -H ldap://ldap-server -b OUR_BASE_DN '(memberOf=.........)' memberOf uid ldapsearch shows the entities with memberOf attribute and the memberOf value if i search without a specific memberOf value in the filter: ldapsearch -o ldif-wrap=no -LLL -x -ZZ -H ldap://ldap-server -b OUR_BASE-DN memberOf The dynlist config is: dynlist-attrset labeledURIObject labeledURI memberOf regards, Andreas

4 8

Re: slapd.conf or OLC (cn=config)
by Eric Fetzer 16 Mar '23

16 Mar '23

Thanks! On Thu, Mar 16, 2023 at 8:50 AM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Thursday, March 16, 2023 9:30 AM -0600 Eric Fetzer > <eric.fetzer(a)gmail.com> wrote: > > > > > Options: > > > > > > Environment="SLAPD_URLS=ldap:/// ldapi:/// ldaps:///" > > Environment="SLAPD_OPTIONS=-F /etc/openldap/slapd.d" > > ExecStart=/usr/libexec/slapd -u ldap -g ldap -h ${SLAPD_URLS} > > $SLAPD_OPTIONS > > > > > > > > Yes, there is a slapd.d directory. > > You're using slapd-config and not slapd.conf then. > > --Quanah > > > >

1 0

Problems with syncrepl and password changes
by Manolo Garcia Alvarez 16 Mar '23

16 Mar '23

Hello. We're having some problems with replication and password changes. Let me explain... In our institution we are using Shibboleth to provide SSO to the users. The credentials are stored in OpenLDAP, but due to the high demand (100 auths/second) and the high volume (more than 700K users), we had to split it in three servers: - one is the producer, which receives all of the changes (both data and password changes), - two are the consumers, sync'd with the producer via syncrepl. The two consumers are behind a load balancer and are used to perform the BINDs and the user lookup. The problem that we are facing is that in some cirscunstances (maybe high load, high traffic?) the syncrepl lasts more than expected, and that causes the next situation: 1. an user changes its password, the object changes its modifyTimestamp to T1 2. before the syncrepl gets to replicate that change, the user tries to authenticate with the new password, the balancer assigns one of the consumers (say C1), tries to bind, but the password is not yet changed, so it fails recording one pwdFailureTime and updating its modifyTimestamp to T2 3. when syncrepl tries to update the object in C1, T2 is older than T1 so it refuses to change the object ("dn_callback : new entry is older than ours cn=XXXXX,dc=acces,dc=uoc,dc=edu ours 20230313155537.264968Z#000000#00d#000000, new 20230313155506.235663Z#000000#00b#000000 ") Resulting in one user with the password changed in the provider and in only one of the consumers. Have you found the same problem? Maybe is there something wrong in our setup? Thanks a lot. ------------------------------ Manolo García Arquitecte de Solucions Universitat Oberta de Catalunya 689 88 30 93 | mgarciaal(a)uoc.edu [image: Universitat Oberta de Catalunya] -- INFORMACIÓ SOBRE PROTECCIÓ DE DADES DE LA UNIVERSITAT OBERTA DE CATALUNYA (UOC) Us informem que les vostres dades identificatives i les contingudes en els missatges electrònics i fitxers adjunts es poden incorporar a les nostres bases de dades amb la finalitat de gestionar les relacions i comunicacions vinculades a la UOC, i que es poden conservar mentre es mantingui la relació. Si ho voleu, podeu exercir el dret a accedir a les vostres dades, rectificar-les i suprimir-les i altres drets reconeguts normativament adreçant-vos a l'adreça de correu emissora o a fuoc_pd(a)uoc.edu <mailto:fuoc_pd@uoc.edu>. Aquest missatge i qualsevol fitxer que porti adjunt, si escau, tenen el caràcter de confidencials i s'adrecen únicament a la persona o entitat a qui s'han enviat. Així mateix, posem a la vostra disposició un delegat de protecció de dades que no només s'encarregarà de supervisar tots els tractaments de dades de la nostra entitat, sinó que us podrà atendre per a qualsevol qüestió relacionada amb el tractament de dades. La seva adreça de contacte és dpd(a)uoc.edu <mailto:dpd@uoc.edu>. INFORMACIÓN SOBRE PROTECCIÓN DE DATOS DE LA UNIVERSITAT OBERTA DE CATALUNYA (UOC) Os informamos de que vuestros datos identificativos y los contenidos en los mensajes electrónicos y ficheros adjuntos pueden incorporarse a nuestras bases de datos con el fin de gestionar las relaciones y comunicaciones vinculadas a la UOC, y de que pueden conservarse mientras se mantenga la relación. Si lo deseáis, podéis ejercer el derecho a acceder a vuestros datos, rectificarlos y suprimirlos y otros derechos reconocidos normativamente dirigiéndoos a la dirección de correo emisora o a fuoc_pd(a)uoc.edu <mailto:fuoc_pd@uoc.edu>. Este mensaje y cualquier fichero que lleve adjunto, si procede, tienen el carácter de confidenciales y se dirigen únicamente a la persona o entidad a quien se han enviado. Así mismo, ponemos a vuestra disposición a un delegado de protección de datos que no solo se encargará de supervisar todos los tratamientos de datos de nuestra entidad, sino que podrá atenderos para cualquier cuestión relacionada con el tratamiento de datos. Su dirección de contacto es dpd(a)uoc.edu <mailto:dpd@uoc.edu>. UNIVERSITAT OBERTA DE CATALUNYA (UOC) DATA PROTECTION INFORMATION Your personal data and the data contained in your email messages and attached files may be stored in our databases for the purpose of maintaining relations and communications linked to the UOC, and the data may be stored for as long as these relations and communications are maintained. If you so wish, you can exercise your rights to access, rectification and erasure of your data, and any other legally held rights, by writing to the sender’s email address or to fuoc_pd(a)uoc.edu <http://fuoc_pd@uoc.edu>. This message and, where applicable, any attachments are confidential and addressed solely to the individual or organization they were sent to. The UOC has a data protection officer who not only supervises the data processing carried out at the University, but who will also respond to any questions you may have about this data processing. You can contact our data protection officer by writing to dpd(a)uoc.edu <http://dpd@uoc.edu>.

3 2

Re: Antw: [EXT] invalid opcode
by Jeffrey Walton 16 Mar '23

16 Mar '23

On Thu, Mar 16, 2023 at 10:50 AM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > --On Thursday, March 16, 2023 11:29 AM -0400 Jeffrey Walton > <noloader(a)gmail.com> wrote: > > >> This doesn't make sense. You should be using an ldapv3 password modify > >> operation on the user account in question and letting the server do the > >> hashing (and also allows password policies, if deployed, to be used). > > > > If I understand things correctly... The server does not hash the > > password. The server never gets to see the plaintext password. > > You don't. > > > See > > https://www.postgresql.org/message-id/379034.1673389287%40sss.pgh.pa.us . > > What does a thread about how postgres works have to do with OpenLDAP or the > LDAP protocol? My bad... I crossed my mailing lists. Jeff

1 0

Re: Problems with syncrepl and password changes
by Manolo Garcia Alvarez 16 Mar '23

16 Mar '23

You're right, sorry. We are running version 2.4.44: OpenLDAP: slapd 2.4.44 (Jan 29 2019 17:42:45) Thanks ! El jue, 16 mar 2023 a las 15:14, Quanah Gibson-Mount (<quanah(a)fast-mail.org>) escribió: > > > --On Thursday, March 16, 2023 11:12 AM +0100 Manolo Garcia Alvarez > <mgarciaal(a)uoc.edu> wrote: > > > > > > > Hello. > > > > We're having some problems with replication and password changes. Let me > > explain... In our institution we are using Shibboleth to provide SSO to > > the users. The credentials are stored in OpenLDAP, but due to the high > > demand (100 auths/second) and the high volume (more than 700K users), we > > had to split it in three servers: > > Thta's not high volume or a large amount of users (just to note). You > didn't provide any information on the version of OpenLDAP in use, which is > critical information. > > --Quanah > > > -- ------------------------------ Manolo García Arquitecte de Solucions Universitat Oberta de Catalunya 689 88 30 93 | mgarciaal(a)uoc.edu [image: Universitat Oberta de Catalunya] -- INFORMACIÓ SOBRE PROTECCIÓ DE DADES DE LA UNIVERSITAT OBERTA DE CATALUNYA (UOC) Us informem que les vostres dades identificatives i les contingudes en els missatges electrònics i fitxers adjunts es poden incorporar a les nostres bases de dades amb la finalitat de gestionar les relacions i comunicacions vinculades a la UOC, i que es poden conservar mentre es mantingui la relació. Si ho voleu, podeu exercir el dret a accedir a les vostres dades, rectificar-les i suprimir-les i altres drets reconeguts normativament adreçant-vos a l'adreça de correu emissora o a fuoc_pd(a)uoc.edu <mailto:fuoc_pd@uoc.edu>. Aquest missatge i qualsevol fitxer que porti adjunt, si escau, tenen el caràcter de confidencials i s'adrecen únicament a la persona o entitat a qui s'han enviat. Així mateix, posem a la vostra disposició un delegat de protecció de dades que no només s'encarregarà de supervisar tots els tractaments de dades de la nostra entitat, sinó que us podrà atendre per a qualsevol qüestió relacionada amb el tractament de dades. La seva adreça de contacte és dpd(a)uoc.edu <mailto:dpd@uoc.edu>. INFORMACIÓN SOBRE PROTECCIÓN DE DATOS DE LA UNIVERSITAT OBERTA DE CATALUNYA (UOC) Os informamos de que vuestros datos identificativos y los contenidos en los mensajes electrónicos y ficheros adjuntos pueden incorporarse a nuestras bases de datos con el fin de gestionar las relaciones y comunicaciones vinculadas a la UOC, y de que pueden conservarse mientras se mantenga la relación. Si lo deseáis, podéis ejercer el derecho a acceder a vuestros datos, rectificarlos y suprimirlos y otros derechos reconocidos normativamente dirigiéndoos a la dirección de correo emisora o a fuoc_pd(a)uoc.edu <mailto:fuoc_pd@uoc.edu>. Este mensaje y cualquier fichero que lleve adjunto, si procede, tienen el carácter de confidenciales y se dirigen únicamente a la persona o entidad a quien se han enviado. Así mismo, ponemos a vuestra disposición a un delegado de protección de datos que no solo se encargará de supervisar todos los tratamientos de datos de nuestra entidad, sino que podrá atenderos para cualquier cuestión relacionada con el tratamiento de datos. Su dirección de contacto es dpd(a)uoc.edu <mailto:dpd@uoc.edu>. UNIVERSITAT OBERTA DE CATALUNYA (UOC) DATA PROTECTION INFORMATION Your personal data and the data contained in your email messages and attached files may be stored in our databases for the purpose of maintaining relations and communications linked to the UOC, and the data may be stored for as long as these relations and communications are maintained. If you so wish, you can exercise your rights to access, rectification and erasure of your data, and any other legally held rights, by writing to the sender’s email address or to fuoc_pd(a)uoc.edu <http://fuoc_pd@uoc.edu>. This message and, where applicable, any attachments are confidential and addressed solely to the individual or organization they were sent to. The UOC has a data protection officer who not only supervises the data processing carried out at the University, but who will also respond to any questions you may have about this data processing. You can contact our data protection officer by writing to dpd(a)uoc.edu <http://dpd@uoc.edu>.

2 1

Re: slapd.conf or OLC (cn=config)
by Eric Fetzer 16 Mar '23

16 Mar '23

Options: Environment="SLAPD_URLS=ldap:/// ldapi:/// ldaps:///" Environment="SLAPD_OPTIONS=-F /etc/openldap/slapd.d" ExecStart=/usr/libexec/slapd -u ldap -g ldap -h ${SLAPD_URLS} $SLAPD_OPTIONS Yes, there is a slapd.d directory. Thanks, Eric On Thu, Mar 16, 2023 at 8:08 AM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Wednesday, March 15, 2023 10:11 AM -0600 Eric Fetzer > <eric.fetzer(a)gmail.com> wrote: > > > > > Looking at my slapd.conf file, I have a bunch of olc settings in it. > > Does that mean I'm OLC? I installed it using this > > site: https://computingforgeeks.com/install-configure-openldap-server- > > centos/ > > What options is slapd running with? Is there a "slapd.d" directory where > its configuration is deployed? > > --Quanah >

2 1

Re: Antw: [EXT] invalid opcode
by Jeffrey Walton 16 Mar '23

16 Mar '23

On Thu, Mar 16, 2023 at 10:08 AM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > --On Saturday, March 11, 2023 7:51 PM +0100 Stefan Kania > <stefan(a)kania-online.de> wrote: > > > For a rootdn > > ------------------- > > dn: olcDatabase={2}mdb,cn=config > > changetype: modify > > replace: olcRootPW > > olcRootPW: > > {ARGON2}$argon2i$v=19$m=4096,t=3,p=1$ZGJmZ2lrbmpiZHZzZ3NhdmRzZw$J6eXYSxY4 > > tDs4l8SdBkIwcAU0OqEEdR0gpFNJ5MSqQs > > ------------------- > > This makes sense, since you can't use the ldapv3 password modify operation > to update this password value. > > > and a posix or simpleSecurityObject: > > ------------------- > > dn: uid=repl-user,ou=users,dc=example,dc=net > > changetype: modify > > replace: userPassword > > userPassword: > > {ARGON2}$argon2i$v=19$m=4096,t=3,p=1$c2FsdHNsYXQ5ODc2NTQzMg$Td51W49s0X74o > > m++/EnMRsP4La3x46KufcGGY01T8+M > > ------------------- > > This doesn't make sense. You should be using an ldapv3 password modify > operation on the user account in question and letting the server do the > hashing (and also allows password policies, if deployed, to be used). If I understand things correctly... The server does not hash the password. The server never gets to see the plaintext password. See https://www.postgresql.org/message-id/379034.1673389287%40sss.pgh.pa.us . Jeff

2 1

slapd.conf or OLC (cn=config)
by Eric Fetzer 16 Mar '23

16 Mar '23

How can I tell which methodology my implementation is using?

2 2

invalid opcode
by Stefan Kania 16 Mar '23

16 Mar '23

Hi to all, I just installed a fresh 2.5 server with the symas-packages and debian 11. I can start the service, but as soon as I try to authenticate for example with: ldapsearch -x -D cn=admin,dc=example,dc=net -W the server crashes, I put the loglevel to "any" and I saw kernel: traps: slapd[18020] trap invalid opcode ip:7febaf26a415 sp:7fc3ad4b69e0 error:0 in libargon2.so.1[7febaf266000+5000] Everytime I try to authenitcate. All packages are up to date. any idea

5 19

Re: Adding to the schema
by Eric Fetzer 09 Mar '23

09 Mar '23

If the other moduleload in there is back_mdb.la, should I also go with ppolicy.la or should I stick with .so? Thanks, Eric On Tue, Mar 7, 2023 at 12:21 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Tuesday, March 7, 2023 12:16 PM -0700 Eric Fetzer > <eric.fetzer(a)gmail.com> wrote: > > > > > I'm using 2.6.4. Sorry, brand new at this, how do I enable it? I > > don't see any references to it in the slapd.conf... I'm in the process > > of converting an ISDS db to OpenLDAP. Kind of daunting so far... > > > Generally speaking: > > In the portion of your configuration loading module: > > modulepath .... > moduleload ppolicy.so > > > In the database section of your configuration where you want to apply > password policies > > > database mdb > ... > > overlay ppolicy > > > Regards, > Quanah > > >

2 1

RoleOccupant filter
by forumforeign 09 Mar '23

09 Mar '23

Hello. I have LDAP groups which keep users inside. Here an example of group: # developer, roles, domain.com dn: cn=developer,ou=roles,dc=domain,dc=com objectClass: organizationalRole cn: developer roleOccupant: uid=user1,ou=people,dc=domain,dc=com roleOccupant: uid=user2,ou=people,dc=domain,dc=com I need to make a search filter, which can say, if certain user belong to group? Or does certain group have a user? Next filter give all uids of group developer: openldapsearch -v -H ldaps://<ldap_host> -x -b 'dc=domain,dc=com' -W -D "cn=vmail,ou=services,dc=domain,dc=com" '(&(objectClass=organizationalRole)(cn=developer))' RoleOccupant When I try to add 'uid' to filter it doesn't return any records: '(&(objectClass=organizationalRole)(cn=developer)(uid=user1,ou=people,dc=domain,dc=com))' RoleOccupant '(&(objectClass=organizationalRole)(cn=developer)(uid=user1,ou=people,dc=domain,dc=com))' '(&(objectClass=organizationalRole)(cn=developer)(uid=user1*))' RoleOccupant How I can change filter, that check if user1 belong to group developer?

3 5

Re: Adding to the schema
by Eric Fetzer 08 Mar '23

08 Mar '23

Is the ... where I set the policy? _______________________________________________________ In the database section of your configuration where you want to apply password policies database mdb ...HERE... overlay policy ________________________________________________________ Thanks, Eric On Tue, Mar 7, 2023 at 12:21 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Tuesday, March 7, 2023 12:16 PM -0700 Eric Fetzer > <eric.fetzer(a)gmail.com> wrote: > > > > > I'm using 2.6.4. Sorry, brand new at this, how do I enable it? I > > don't see any references to it in the slapd.conf... I'm in the process > > of converting an ISDS db to OpenLDAP. Kind of daunting so far... > > > Generally speaking: > > In the portion of your configuration loading module: > > modulepath .... > moduleload ppolicy.so > > > In the database section of your configuration where you want to apply > password policies > > > database mdb > ... > > overlay ppolicy > > > Regards, > Quanah > > >

2 1

Re: Backup Mirrormode setup
by Meike Stone 08 Mar '23

08 Mar '23

Am Mi., 16. März 2022 um 21:39 Uhr schrieb Quanah Gibson-Mount <quanah(a)fast-mail.org>: > > > > --On Wednesday, March 16, 2022 10:23 PM +0100 Meike Stone > <meike.stone(a)googlemail.com> wrote: > > > > > We are still using the bdb backend and the latest 2.4.59 (don't ask, > > it will be replaced soon) and I remember, a "few" years ago, I had > > problems with slapcat and online databases, because the server was > > stucking for a while and answers were delayed .. > > (The Admin Guide tells, that "Backups are managed slightly differently" > > ...) Secondly, while offline, I can copy the whole database directory > > including the transaction logs .. > > Ah, ok. Yes, you could set up a read-only consumer node to take backups > from. I'd highly prioritize moving to a supported release of OpenLDAP with > the back-mdb backend as well (I see you say it should be replaced soon). :) > Oh my god, almost a year has passed - now finally our department wants to migrate to the latest version 2.5.14. I'm responsible for the Master LDAP-Server, but there are a few ro-replicas in other departments where I'm not responsible - and I have no access. Is it possible to migrate the master server to the new version and update the replicas (running 2.4.59) later, independent from the master (migration)? Are there any problems to be expected? Regards and many thanks Meike

2 1

dynlist's +memberOf attribute not searchable/fetchable with anonymous binds
by Michal Soltys 08 Mar '23

08 Mar '23

Hi, Consider following simple dynlist config (v2.5.13): groupOfURLs labeledURI uniqueMember+memberOf@groupOfUniqueNames So for static groups we get a dynamic memberOf for each user that is a member of some static group, for example: DN: cn=TouK,ou=TouK,ou=Group,dc=touk,dc=pl ... uniqueMember: cn=Michał Sołtys,ou=Touki,ou=People,dc=touk,dc=pl DN: cn=Michał Sołtys,ou=Touki,ou=People,dc=touk,dc=pl ... memberOf: cn=touk,ou=touk,ou=group,dc=touk,dc=pl Now this works fine if we bind with a user and do a search. But if we do an anonymous search no memberOf is returned or searchable by. For example: assume following ACLs at the top: {0}to * by dn=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break {1}to dn.subtree=ou=People,dc=touk,dc=pl attrs=entry,entryUUID,memberOf,@toukAnonAccess by anonymous =scr by * break {2}to dn.subtree=ou=Group,dc=touk,dc=pl attrs=entry,@groupOfUniqueNames,@groupOfNames by anonymous =scr by * break ... and the following search: ldapsearch -x -H ldaps://ldap.touk.pl -s sub -b 'ou=Touki,ou=People,dc=touk,dc=pl' -o ldif-wrap=no -LLL -v memberOf entryUUID we get the following results: ldap_initialize( ldaps://ldap.touk.pl:636/??base ) filter: (objectclass=*) requesting: memberOf entryUUID dn: ou=Touki,ou=People,dc=touk,dc=pl entryUUID: 6be7e4f8-a800-103a-9fd7-3100241d53c2 dn: cn=Jan Gajl,ou=Touki,ou=People,dc=touk,dc=pl entryUUID: 6c39df1a-a800-103a-8089-3100241d53c2 Why is memberOf omitted with anonymous binds when search explicitly (or implicitly via +) requests it and acls grant required rights ? With explicit binds or EXTERNAL - memberOf is returned (and searchable) correctly. Is there something else that is required for memberOf to work with anonymous binds ?

1 1

Re: Adding to the schema
by Eric Fetzer 07 Mar '23

07 Mar '23

So by configuration loading module, do you mean the slapd.ldif file? If so, since I already loaded it, can I modify and reload it or would that not work? If that's the case, can I load just a subset of it? Thanks, Eric On Tue, Mar 7, 2023 at 12:21 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Tuesday, March 7, 2023 12:16 PM -0700 Eric Fetzer > <eric.fetzer(a)gmail.com> wrote: > > > > > I'm using 2.6.4. Sorry, brand new at this, how do I enable it? I > > don't see any references to it in the slapd.conf... I'm in the process > > of converting an ISDS db to OpenLDAP. Kind of daunting so far... > > > Generally speaking: > > In the portion of your configuration loading module: > > modulepath .... > moduleload ppolicy.so > > > In the database section of your configuration where you want to apply > password policies > > > database mdb > ... > > overlay ppolicy > > > Regards, > Quanah > > >

1 0

Re: Adding to the schema
by Eric Fetzer 07 Mar '23

07 Mar '23

I'm using 2.6.4. Sorry, brand new at this, how do I enable it? I don't see any references to it in the slapd.conf... I'm in the process of converting an ISDS db to OpenLDAP. Kind of daunting so far... Thanks, Eric On Tue, Mar 7, 2023 at 12:10 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Monday, March 6, 2023 11:23 AM -0700 Eric Fetzer > <eric.fetzer(a)gmail.com> wrote: > > > > > Hi All, > > > > > > I need to add to my schema on my freshly built server. > > If you're using OpenLDAP 2.5 or later, the ppolicy schema is built into > the > ppolicy overlay and you should not be loading it separately at all. I > would note that all releases prior to OpenLDAP 2.5 are historic and not > supported. > > Regards, > Quanah > > > >

2 1

Adding to the schema
by Eric Fetzer 07 Mar '23

07 Mar '23

Hi All, I need to add to my schema on my freshly built server. I found a schema that meets my needs @ https://opensource.apple.com/source/OpenLDAP/OpenLDAP-143/OpenLDAP/servers/…. My problem is that it doesn't seem to include a "ppolicy.ldif" file. The only way I know how to add to the schema is with an include statement in slapd.ldif. What am I missing? Thanks, Eric

2 2

issues with disabling filtered searches for memberURL groups
by Kartik Subbarao 07 Mar '23

07 Mar '23

One of the changes from 2.4 to 2.5 is that dynlist groups are now returned with (member=memberDN) searches. This is potentially appealing, but even with the ITS#9929 performance improvements, given the number of dynlist groups we have, search times are significantly impacted. We'd like to be able to cleanly disable this feature and exclude dynlist groups from (member=memberDN) filter consideration. The only way I've found so far is to patch the dynlist code itself. What I'm currently doing is adding a continue statement right above this line in dynlist_search(): https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_5_14/s… That way the member searches are excluded, but dynlists otherwise work as expected. Here is the dynlist config we're using, just basic support for groupOfURLs/memberURL: overlay dynlist dynlist-attrset groupOfURLs memberURL member Is there some way to achieve my goal without having to patch the code? Or should I open an ITS feature request to add a configurable option to exclude dynlists from member searches? Thanks, -Kartik

1 0

olcAccess don't working
by bourguijl＠gmail.com 07 Mar '23

07 Mar '23

Dears, I've configured a META ldap instance pointing to a LDAP backend. In this backend, there are a few ACLs but which ones don't restrict ldapsearch that I do from the META frontend. I just have an issue when I set some ACLs on the META frontend and more specially when I insert attrs=xxx in the ACL. Here is my ACL = OK olcAccess : {0}to dn.one="ou=staff,o=mobistar.be" by dn="uid=a0621004,ou=ObeExternalITOnGcp,ou=partners,o=mobistar.be" read NOT OK olcAccess : {0}to dn.one="ou=staff,o=mobistar.be" attrs=uid by dn="uid=a0621004,ou=ObeExternalITOnGcp,ou=partners,o=mobistar.be" read Can you explain why when I restrict to an attribute, my ldapsearch didn't provide me any response as expected ? Thx in advance, J-L.

2 1

olcDbIDAssertBind
by bourguijl＠gmail.com 06 Mar '23

06 Mar '23

Dears, I've used olcDbIDAssertBind in a META ldap config to use another login/password to search in backend but it's not taken into account, that's still the client user that's used to fetch data in the backend. Is it he correct parameter to use in order to "supersede" the client user by another one (generic) known by the backend ? Thx for help. Brgds, Jean-Luc.

1 0

Please help to check the right schema.
by luckydog xf 03 Mar '23

03 Mar '23

Hi, list, I'm trying to migrate opendj to openLDAP. Here is a customized schema. === dn: cn=schema objectclass: top objectclass: ldapSubentry objectclass: subschema cn: schema attributeTypes: ( 1.12.23.34.45.56.780 NAME 'active' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 X-SCHEMA-FILE '99-user.ldif' ) attributeTypes: ( 1.12.23.34.45.56.782 NAME 'accountName' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-SCHEMA-FILE '99-user.ldif' ) attributeTypes: ( 1.12.23.34.45.56.784 NAME 'djGroups' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-SCHEMA-FILE '99-user.ldif' ) attributeTypes: ( 1.12.23.34.45.56.786 NAME 'departmentId' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-SCHEMA-FILE '99-user.ldif' ) attributeTypes: ( 1.12.23.34.45.56.788 NAME 'department' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-SCHEMA-FILE '99-user.ldif' ) attributeTypes: ( 1.12.23.34.45.56.790 NAME 'companyCode' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-SCHEMA-FILE '99-user.ldif' ) attributeTypes: ( 1.12.23.34.45.56.792 NAME 'parent' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-SCHEMA-FILE '99-user.ldif' ) ds-sync-generation-id: 8408 ds-sync-state: 01050186432c61a90000f9ca10880 ds-sync-state: 0105017a002b3170002f4a1b16311 modifiersName: cn=Administrator modifyTimestamp: 20190711063414Z objectClasses: ( 1.12.23.34.45.56.880 NAME 'idmExt' DESC 'idm user extended attributes' SUP top AUXILIARY MUST active MAY ( accountName $ djGroups $ departmentId $ department $ companyCode ) X-SCHEMA-FILE '99-user.ldif' ) objectClasses: ( 1.12.23.34.45.56.890 NAME 'idmDept' DESC 'idm department extended attributes' SUP top AUXILIARY MAY parent X-SCHEMA-FILE '99-user.ldif' ) === I changed it to LDAP compliant one. --- dn: cn=djuser,cn=schema,cn=config objectClass: olcSchemaConfig cn: djuser olcAttributeTypes: ( 1.12.23.34.45.56.780 NAME 'active' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 ) olcAttributeTypes: ( 1.12.23.34.45.56.782 NAME 'accountName' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: ( 1.12.23.34.45.56.784 NAME 'djGroups' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: ( 1.12.23.34.45.56.786 NAME 'departmentId' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: ( 1.12.23.34.45.56.788 NAME 'department' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: ( 1.12.23.34.45.56.790 NAME 'companyCode' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: ( 1.12.23.34.45.56.792 NAME 'parent' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcObjectClasses: ( 1.12.23.34.45.56.880 NAME 'idmExt' DESC 'idm user extended attributes' SUP top AUXILIARY MUST active MAY ( accountName $ djGroups $ departmentId $ department $ companyCode ) ) olcObjectClasses: ( 1.12.23.34.45.56.890 NAME 'idmDept' DESC 'idm department extended attributes' SUP top AUXILIARY MAY parent ) ----- It can be imported by `ldapadd -Y EXTERNAL -H ldapi:/// -f 99-user.ldif` However, there is nothing in === [root@hq-repo cn=config]# more cn\=schema/cn\=\{10\}djuser.ldif # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 310b21fa dn: cn={10}djuser objectClass: olcSchemaConfig cn: {10}djuser structuralObjectClass: olcSchemaConfig entryUUID: 6b852150-4b97-103d-86fe-7b79b4eef873 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20230228093837Z entryCSN: 20230228093837.038174Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20230228093837Z === I'm using openldap 2.4. Anything wrong with my schema ? Thanks.

2 3

dynlist few question (memberof replacement, reverse searches)
by Michal Soltys 02 Mar '23

02 Mar '23

Hi, Few questions regarding dynlist as a replacement of memberof overlay. Version: 2.5.13+dfsg-2~bpo11+1 on debian bullseye 1) in relatively simple environment (2 servers, multiprovider, syncrepl and keepalived) we've been using memberof overlay - with memberOf explicitly filtered out in syncrepl configuration (exattrs=memberOf). This has been working fine so far across many versions - but considering the warning in slapo-memberof manpage is this overlay used in this fashion safe or are there other issues that eventually might show up ? 2) I've been experimenting a bit with dynlist as a replacement; judging from examples/manual it seems it was primarily created to populate a dynamic group while doing the search over users under a constraint of a filter; but it seems it's working just fine in reverse way as well, e.g. consider: dynlist config: olcDynListAttrSet = toukPerson labeledURI dgMemberOf group with manually added members: cn=ADM,ou=TouK,ou=Group,dc=touk,dc=pl a user: uniqueMember=cn=Michał Sołtys,ou=Touki,ou=People,dc=touk,dc=pl and relevant attributes in user's entry: objectClass = toukPerson labeledURI = ldap:///ou=TouK,ou=Group,dc=touk,dc=pl??sub?(uniqueMember=cn=Michał Sołtys,ou=Touki,ou=People,dc=touk,dc=pl) This seems to be doing what we are expecting - populating dynamically dgMemberOf with the groups the user has membership in. While this is working, is it ok to use this overlay in this fashion (search over groups instead of over users) ? 3) my last question is more of a curiosity - what case scenario are for additional [+<memberOf-ad>[@<static-oc>[*]]] attributes ? No matter what I tried in what way, neither +memberOf-ad nor +static-oc had any effect whatsoever.

1 1

ch_malloc of 0 bytes failed on Meta backend
by sumanbadra＠gmail.com 01 Mar '23

01 Mar '23

Hi, We have been using Meta backend with multiple AD domain controllers as targets. OpenLDAP version is 2.4.56 and installed on RHEL 8.6 Azure hosted servers. We have two such nodes with the same setup. I have been trying to find the root cause for the error "ch_malloc of 0 bytes failed on Meta backend" found on the two servers. Service was crashed on both servers after this error. After starting the OpenLDAP service, it has been working fine so far. My observations so far: - Our Azure team did not find any abnormalities on the servers w.r.t the memory utilisation by LDAP during the incident. - Stats around the time when issue occurred sar -r kbmemfree kbavail kbmemused %memused kbbuffers kbcached kbcommit %commit kbactive kbinact kbdirty 01:50:01 PM 25202860 29022816 7519888 22.98 13808 5385664 4736872 14.48 2349572 4157132 64 02:00:01 PM 25195656 29018052 7527092 23.00 13808 5388120 4767748 14.57 2349572 4163232 44 02:10:00 PM 25197340 29010572 7525408 23.00 13808 5386752 4783920 14.62 2352524 4158856 3336 02:20:01 PM 25201220 29016192 7521528 22.99 13808 5388296 4789868 14.64 2352516 4154632 52 02:30:01 PM 25196500 29013836 7526248 23.00 13808 5390708 4789412 14.64 2352516 4159140 36 02:40:01 PM 25181840 29002912 7540908 23.04 13808 5402364 4782228 14.61 2352528 4173032 144 02:50:01 PM 25170748 28994608 7552000 23.08 13808 5413236 4758840 14.54 2352516 4185172 1092 03:00:01 PM 25172224 28997852 7550524 23.07 13808 5414920 4729152 14.45 2352520 4182356 48 03:10:01 PM 24976028 28806984 7746720 23.67 13808 5428036 5007976 15.30 2353012 4375608 4940 - We did not set any cache specifically as meta does not store any data - Error shows 0 bytes rather than any specific number I would really appreciate if you can share any pointer which would help dig further. Thank you, Suman

2 2

lmdb partial update of existing records
by g.fanini＠gmail.com 28 Feb '23

28 Feb '23

What is the recommended way to update partial substrings of existing records in lmdb ? I could not find a way that allows to transfer not the entire record, thus wasting memory bandwidth, but only say overwrite a single byte within say a 1 mbyte record, is it acceptable/safe to modify : mdb_put(offset, partial_len) mdb_cursor_put(offset, partial_len) ... if (F_ISSET(flags, MDB_RESERVE)) data->mv_data = olddata.mv_data; else if (!(mc->mc_flags & C_SUB)) { if(!offset && !partial_len) memcpy(olddata.mv_data, data->mv_data, data->mv_size); else memcpy((char*)olddata.mv_data+offset, data->mv_data, partial_len);// allow partial update within existing record at offset } else { memcpy(NODEKEY(leaf), key->mv_data, key->mv_size); goto fix_parent; } ... further to that, is it possible to allow retrieving current record size, data with MDB_RESERVE, and what should be done if anything in case one opts not to write anything into the returned data } else if ((data->mv_size == olddata.mv_size) || F_ISSET(flags, MDB_RESERVE) )// allow retrieving current record size, data with MDB_RESERVE { /* same size, just replace it. Note that we could * also reuse this node if the new data is smaller, * but instead we opt to shrink the node in that case. */ if (F_ISSET(flags, MDB_RESERVE)) { if (!data->mv_size) *data = olddata;// allow retrieving current size, data with MDB_RESERVE by querying with size 0 else data->mv_data = olddata.mv_data; }

1 0

dynlist modul pageresult bug
by Andreas Ladanyi 28 Feb '23

28 Feb '23

Hi, is the pageresult issue of dynlist solved in the new 2.5.14 release of slapd or will it be solved in the near future ? cheers, Andi

2 1

Content Sync Refresh Required
by Geert Hendrickx 28 Feb '23

28 Feb '23

Hi We're on OpenLDAP 2.5.14, built from source on EL 8. After dropping the accesslog on an MMR master, we keep seeing on all replica's: > do_syncrep2: rid=xxx (4096) Content Sync Refresh Required and all replica's keep falling back to refresh mode every few minutes. It's strange because we do this more often (typically after batch updates, which leaves a large freelist in the accesslog upon pruning), but it's the first time we hit this issue. We stopped the master (at a time no updates are coming in), drop the accesslog, and start it again. Does it make sense to wait until this fixes itself? Or should I fix this manually somehow? I already tried mdb_copying the provider db to the replica's, but the same thing keeps happening. In the meantime replication is working very slowly... Geert

2 8

META Ldap
by bourguijl＠gmail.com 27 Feb '23

27 Feb '23

Dears, I've created a META configuration pointing to another backend ldap for which I'd like to use a generic user which will be used as unique user to fetch datas in backend requested by all users coming from the META proxy frontend. I did following dynamic configuration : dn: olcDatabase={2}meta objectClass: olcDatabaseConfig objectClass: olcMetaConfig olcDatabase: {2}meta olcSuffix: o=mobistar.be olcAddContentAcl: FALSE olcLastBind: TRUE olcReadOnly: FALSE olcRootDN: cn=directory manager,o=mobistar.be olcRootPW: secret olcSyncUseSubentry: FALSE olcMonitoring: FALSE olcDbOnErr: continue olcDbPseudoRootBindDefer: TRUE olcDbSingleConn: FALSE olcDbUseTemporaryConn: FALSE olcDbConnectionPoolMax: 16 olcDbBindTimeout: 1000000 olcDbCancel: abandon olcDbChaseReferrals: FALSE olcDbNoRefs: FALSE olcDbNoUndefFilter: FALSE olcDbProtocolVersion: 3 olcDbRebindAsUser: FALSE olcDbSessionTrackingRequest: FALSE olcDbTFSupport: no structuralObjectClass: olcMetaConfig entryUUID: c113f986-35b0-103d-9f4f-85924223dda7 creatorsName: cn=config createTimestamp: 20230131124432Z olcMaxDerefDepth: 15 olcDbNretries: 100 olcLastMod: FALSE entryCSN: 20230227112001.500938Z#000000#001#000000 modifiersName: cn=manager,cn=config modifyTimestamp: 20230227112001Z dn: olcMetaSub={0}uri objectClass: olcMetaTargetConfig olcMetaSub: {0}uri olcDbKeepalive: 0:0:0 olcDbTcpUserTimeout: 0 olcDbCancel: abandon olcDbChaseReferrals: FALSE olcDbNoRefs: FALSE olcDbNoUndefFilter: FALSE olcDbNretries: 100 olcDbProtocolVersion: 3 olcDbRebindAsUser: FALSE olcDbSessionTrackingRequest: FALSE olcDbTFSupport: no structuralObjectClass: olcMetaTargetConfig entryUUID: c113fc9c-35b0-103d-9f50-85924223dda7 creatorsName: cn=config createTimestamp: 20230131124432Z olcDbBindTimeout: 1000000 olcDbURI: "ldap://accmasterldapcorp.nonprod.priv.orange.be:389/o=mobistar.be olcDbIDAssertBind: mode=self flags=non-prescriptive,proxy-authz-non-critical b indmethod=simple timeout=0 network-timeout=0 binddn="uid=ldapproxyuser_acc,ou =test,ou=system,o=mobistar.be" credentials="secret" keepalive=0:0:0 tc p-user-timeout=0 entryCSN: 20230227142538.253522Z#000000#001#000000 modifiersName: cn=manager,cn=config modifyTimestamp: 20230227142538Z But when I do a ldapsearch with a user known in the backend from the META, it'll not take the olcDbIDAssertBind and it didn't found nothing. If I do the same request directly on the backend, I get what I'm searching for. Can you help me by giving me some advice about what I'm missing or what's erroneous ? Thx in advance, Jean_luc.

1 0

dynlist dont deliver memberof attribute
by Andreas Ladanyi 27 Feb '23

27 Feb '23

Hi, iam using one 2.5 Master / Provider / syncprov and some 2.5 Slaves / Consumers / syncrepl. I added the dynlist to generate memberOf attribute to slapd.conf on Master and all Slaves. Problem is only on some slaves the dynlist doesnt generate memberof attribute output when ldapsearch to a user. Iam using the objectClass labeledURIObject and attribute labeledURI to store the LDAP URI for dynlist to trigger / generate the DN of group membership for memberof attribute of the user. The labeledURI attribute is replicated successfully. User entry output on non working slaves with attribute labeledURI, memberof is missing: ldapsearch -x -LLL -ZZ -H ldap://non_working_slave -b 'ou=X,dc=department,dc=organization,dc=X,dc=X' '(&(uid=X))' results in the user entry with all objectClasses and all attributes except the memberof attribute. #start snip: ... objectClass: labeledURIObject ... labeledURI: ldap:///dc=department,dc=organization,dc=X,dc=X??sub?(&(objectClass=groupOfNames)(member=uid=XXXX,ou=account,ou=X,dc=department,dc=organization,dc=X,dc=X)) #stop snip slapd.conf: overlay dynlist dynlist-attrset labeledURIObject labeledURI memberOf The difference between working and non working slaves is the length of ACL list. The important ACL entry is: access to dn.sub=dc=department,dc=organization,dc=X,dc=X \ attrs=entry by peername=IP_subnet read by * break access to dn.regex=^[^,]+,ou=(account|group|groupOfNames),ou=X,dc=department,dc=organization,dc=X,dc=X$ by peername=IP_subnet read by * break i set no attrs= parameter at "access to dn.regex" rule to output all attributes. cheers, Andreas

1 1

ACL issue
by eric.innocente＠univ-avignon.fr 23 Feb '23

23 Feb '23

Hi, Using OpenLDAP 2.4 and this ACL : ===== olcAccess: {0}to * by dn="cn=admin,ou=ldap,dc=univ-avignon,dc=fr" write by * break olcAccess: {1}to attrs=userPassword by self write by anonymous auth by * none olcAccess: {2}to attrs=myAttribute by dn="cn=myUser,ou=ldap,dc=univ-avignon,dc=fr" read by * none olcAccess: {3}to * by * read ===== in the aim (rule {2}) to grant read access to attribute 'myAttribute' for myUser and no other user (except admin). As wanted, [R1] with authentified user myUser : [R1] ldapsearch -x -LLL -h <myLDAP> -b 'ou=people,dc=univ-avignon,dc=fr' -D 'cn=myUser,ou=ldap,dc=univ-avignon,dc=fr' -w <secret> "(uid=someUid)" myAttribute give me the dn and the required "myAttribute" : dn: uid=someUid,ou=people,dc=univ-avignon,dc=fr myAttribute: <attribute value> and [R2] with another authentified user : [R2] ldapsearch -x -LLL -h <myLDAP> -b 'ou=people,dc=univ-avignon,dc=fr' -D 'cn=anotherUser,ou=ldap,dc=univ-avignon,dc=fr' -w <secret> "(uid=someUid)" myAttribute does NOT give me the required "myAttribute", only the dn : dn: uid=someUid,ou=people,dc=univ-avignon,dc=fr BUT by replacing "read" by "none" in rule {3}, I get an error "No such object (32)" with either [R1] and [R2]. Since rule {3} should not be evaluated after matching rule {2}, I don't understand why modifying rule {3} modifies the behaviour. And by replacing "read" by "search" in rule {3}, I no longer get an error, but I do NOT obtain the required "myAttribute" and nor the dn, with neither [R1] nor [R2]. Does it mean that "read" in rule {3} was necessary to read the dn ? And that without reading the dn, rule {2} cannot be evaluated ? Please, help me ! Eric

2 1

Using Ppolicy in a provider peer cluster can trigger consumer refresh condition
by James Rawlins 22 Feb '23

22 Feb '23

Hi there, My ldap consists of a cluster of 3 providers that all replicate to each other, and a fleet of consumers replicating from them, and we have ppolicy installed on our providers and consumers both, though we're currently not using it to enforce any particular policies automatically. I've recently discovered a situation where a script could fail to login with a non-rootDN service account to all three provider instances in short order. The providers seem to be able to figure things out quickly, but the consumers sometimes detect some ContextCSN inconsistency and when this happens consumers to enter a REFRESH state caused by updates to the operational attributes on the service account's dn entry in all three providers at nearly the same time. In production this can cause latency due to the extra CPU and network traffic of refreshing all consumers at once. The only relevant documentation I've been able to find for this use case are from https://linux.die.net/man/5/slapo-ppolicy: Note that the current IETF Password Policy proposal does not define how these operational attributes are expected to behave in a replication environment. In general, authentication attempts on a slave server only affect the copy of the operational attributes on that slave and will not affect any attributes for a user's entry on the master server. Operational attribute changes resulting from authentication attempts on a master server will usually replicate to the slaves (and also overwrite any changes that originated on the slave). These behaviors are not guaranteed and are subject to change when a formal specification emerges. And the related ability for consumers to send updates up a replication chain using the chain overlay: ppolicy_forward_updates Specify that policy state changes that result from Bind operations (such as recording failures, lockout, etc.) on a consumer should be forwarded to a master instead of being written directly into the consumer's local database. This setting is only useful on a replication consumer, and also requires the updateref setting and chain overlay to be appropriately configured. tl;dr Ppolicy wrote operational attributes to a service account's dn to all of my provider instances at the same time when my SA used the wrong password to login to them all at once, and caused all my consumers to refresh at the same time. My question is: is the ppolicy overlay inherently unsafe for a provider cluster? Right now I'm considering these options to get rid of the risk of accidentally triggering a consumer REFRESH again: - Remove the ppolicy overlay from the replicated backend (I'm still checking if there's anything we actually use it for, but if it's inherently unsafe in this configuration then it's gotta go) - Move all of the service accounts to another database that ppolicy is not installed on. Thanks!

2 1

Re: Antw: [EXT] Re: Entering Multi-Byte Values for DirectoryString attributes
by Ede Wolf 22 Feb '23

22 Feb '23

> Hi! > > I'd say: Get the proper app (eg. BabelPad on Windows, see attachment) and then BASE64-encode the string. > > Regards, > Ulrich > Thanks, but windows is not an option. Again, base64 encoding is fine with echo -en "" | base64. With a browser I can search for the symbol and do copy paste into the ldif. All that works fine, even if my console font does not even support that symbol. I've done it. But feels a bit hackish. I just hoped, there was an option, to tell the server, when the ldif has this sequence, interpret it as an ecoding, not as a literal string. Now I know, this does only work for the dn (and maybe only openldap, will test, see other post), and for the rest I do have a work around.

2 3

Entering Multi-Byte Values for DirectoryString attributes
by Ede Wolf 22 Feb '23

22 Feb '23

Hello, This is probably more a ldif than an OpenLDAP question, but still, maybe somebody knows the answer: Is there a way to put multibyte characters into an attribute value and let the server know, these are not to be treated literally, but are utf8 character encodings? I've tried to dig into rfc3629 and 4517, but those were above my capabilities. It does of course work for the dn, it also works, if I provide base64 code to the attributes, but is there a way, to directly put them into a ldif an let the server know, these are character encodings? Also, rfc2849 only talks about not line breaking multi-byte characters. In this silly, but easy, example, both cn: and description: are entered literally, while the dn words as intended: dn: cn=A \F0\9F\99\82 Test,dc=example,dc=com cn: A \F0\9F\99\82 Test objectClass: person sn: Test description: %xF0%x9F%x99%x82 Test This is about understanding, not about the intention, to really put a smily into a dn. I am aware, this a potential recipe for disaster. Also, I am aware, the OpenLDAP kindly adds a proper cn value anyway, but that does not help here. And still would leave the description open. Also, as mentioned before: echo -en "A \xF0\x9F\x99\x82 Test" | base64 is a viable workaround, but a cumbersome one. So maybe there is an easier way Thanks Ede

4 11

Re: Antw: [EXT] Entering Multi-Byte Values for DirectoryString attributes
by Ede Wolf 21 Feb '23

21 Feb '23

Am 20.02.23 um 16:18 schrieb Ulrich Windl: > Hi! > > Ever notices the "double-colons" "::"? > > For example: > userPassword:: e1NTSEF9... > > Kind regards, > Ulrich Windl > > Yes, but I am unaware, that those hint to something else than base64 encoding? I may stand more than happily corrected, tough My question was more, how to provide single unicode charater encoding within a ldif file, like it can be done with the dn, where I may provice the hex values for a character.

1 0

Re: OpenSSL1.1.1 support after its EOL
by Anil 1. Tadikamalla (EXT-NSB) 21 Feb '23

21 Feb '23

Hi Team, Can you please help to address below queries ASAP from OpenLDAP point of view: 1. Please do let us know if OpenLDAP can provide extended support of OpenSSL1.1.1 beyond the EOL(End of life cycle) i.e after september 2023? 2. Does OpenLDAP depend on RHEL for OpenSSL support or Does it package OpenSSL on its own? If it depends on RHEL and RHEL introduces OpenSSL3.0 support, how would this be handled by OpenLDAP? Regards, Anil Kumar ________________________________ From: Anil 1. Tadikamalla (EXT-NSB) Sent: Friday, December 9, 2022 9:54:28 AM To: openldap-technical(a)openldap.org Cc: Seenivasan 1. Alagarsamy (EXT-NSB) Subject: Re: OpenSSL1.1.1 support after its EOL Hi Team, GENTLE REMINDER.... Can you please help to address below query to from OpenLDAP Point of View ASAP. Does OpenLDAP depend on RHEL for OpenSSL support or Does it package OpenSSL on its own? If it depends on RHEL and RHEL introduces OpenSSL3.0 support, how would this be handled by OpenLDAP? Regards, Anil Kumar ________________________________ From: Anil 1. Tadikamalla (EXT-NSB) Sent: Friday, December 9, 2022 12:53 AM To: openldap-technical(a)openldap.org Cc: Seenivasan 1. Alagarsamy (EXT-NSB) Subject: OpenSSL1.1.1 support after its EOL Hi Team, Please do let us know if OpenLDAP can provide extended support of OpenSSL1.1.1 beyond the EOL(End of life cycle) i.e after september 2023? Regards, Anil Kumar

2 3

ppolicy and olcPPolicyUseLockout
by Stefan Kania 21 Feb '23

21 Feb '23

Hello, I have the following configuration for my overlay ppolicy (OpenLDAP 2.6) It's a testing system! --------- dn: olcOverlay={0}ppolicy,olcDatabase={2}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: {0}ppolicy olcPPolicyDefault: cn=default,ou=policies,dc=example,dc=net olcPPolicyHashCleartext: FALSE olcPPolicyForwardUpdates: FALSE olcPPolicyUseLockout: TRUE --------- My default-policy: --------- dn: cn=default,ou=policies,dc=example,dc=net objectClass: pwdPolicy objectClass: person cn: default pwdAttribute: userPassword pwdAllowUserChange: TRUE pwdExpireWarning: 1440 pwdGraceAuthNLimit: 5 pwdInHistory: 5 pwdLockout: TRUE pwdFailureCountInterval: 300 pwdMaxFailure: 5 pwdMinLength: 8 sn: OurDefaultPolicy pwdLockoutDuration: 120 pwdMustChange: TRUE pwdMaxAge: 2000 --------- Everything works, but I don't get a different message if the account is locked because of to many bad locking attempts. The manpage of slapo-ppolicy telling me: ppolicy_use_lockout = TRUE then a AccountLocked is shown. But I still get: Permission denied, please try again. if I'm giving the correct password after the account is locked because of to many bad locking attempts. Did I miss something? If "yes" what? Thank's Stefan

2 1

Tools parsing dc=foo URLs
by Norman Gray 20 Feb '23

20 Feb '23

Greetings. This command fails in an unexpected way: % ldapsearch -x -H 'ldap:///dc=example,dc=net' '(cn=foo)' Could not parse LDAP URI(s)=ldap:///dc=example,dc=net (3) It appears that ldapsearch wants me to escape the '=' and ',' in that URI: % ldapsearch -x -H 'ldap:///dc%3dexample%2cdc%3dnet' '(cn=foo)' DNS SRV: Could not turn domain=example.net into a hostlist But why? The manpage for ldapsearch says -H ldapuri Specify URI(s) referring to the ldap server(s); a list of URI, separated by whitespace or commas is expected; only the protocol/host/port fields are allowed. As an exception, if no host/port is specified, but a DN is, the DN is used to look up the corresponding host(s) using the DNS SRV records, according to RFC 2782. The DN must be a non-empty sequence of AVAs whose attribute type is "dc" (domain component), and must be escaped according to RFC 2396. I read that as clearly saying (via the 'exception' branch of that paragraph) that the first -H argument is correct. RFC digression: According to RFC 2396, the /dc... is `"/" path_segments`, segments are composed of *pchar, and pchar = unreserved | escaped | ":" | "@" | "&" | "=" | "+" | "$" | "," ...which includes both '=' and ','. Thus those characters don't need to be escaped, by RFC 2396. Or, put another way, 'ldap:///dc=example,dc=net' _is_ escaped according to RFC2396, in the sense that nothing in it needs to be escaped. Looking instead at RFC 4516, the 'dn' in the 'ldapurl' is a 'distinguishedName' from RFC 4514 which (Sect.3) permits '=' and ',' to be included. Sect.2.1 of 4516 requires that the URI must include <reserved>, <unreserved> or <pct-encoded> of RFC 3986, but if we look at that, then Sect.2.2 indicates that <reserved> includes both '=' and ','. Thus the behaviour of ldapsearch, when parsing the -H option, doesn't appear to match the documentation. Explanation: Looking at common.c:tool_args and common.c line 1199, I see that it calls ldap_url_parselist to break the -H argument into a list of URIs, and this will separate dc=example,dc=net at the comma. And sure enough, in practice it's only the ',' that has to be escaped by %2c. I believe this behaviour doesn't match the manpage, which (clearly in my reading of it) requires either a list of protocol/host/port URIs OR (the exception) a single URI containing no host/port but only a DN. That suggests that common.c:tool_args has to detect that exception/second case. Apart from the documentation issue, having to escape commas is both repeatedly surprising and a pain in the neck on the occasions when I want to use the dc=... syntax with ldapsearch. Re detecting that exception, searching for "///" in the ldapuri string would seem to be sufficient, and calling ldap_url_parselist_int in that case (instead of ldap_url_parselist) with a sep argument of " " looks like it would do the job with a minimal change to the code. Best wishes, Norman -- Norman Gray : https://nxg.me.uk

3 4

OpenLDAP proxy to AD
by Sajesh Singh 15 Feb '23

15 Feb '23

RHEL 8 OpenLDAP 2.6.4 Trying to use OpenLDAP as a proxy to AD and most of my configuration seems to be working as expected, but when I try to use the rwm-suffixmassage option an LDAP search against the server returns the following error: No such object (32) If I remove the rwm-suffixmassage option then I am returned the expected entry. Relevant config snippet: suffix "dc=subdomain,dc=domain,dc=tld" uri "ldaps://dc1.subdomain.domain.tld/ ldaps://dc2.subdomain.domain.tld/" chase-referrals no idassert-bind bindmethod=simple binddn="cn=user,ou=OU,dc=subdomain,dc=domain,dc=tld" credentials="secret" mode=self tls_reqcert=demand tls_cacert=cert.file flags=non-prescriptive overlay rwm rwm-suffixmassage "dc=subdomain,dc=domain,dc=tld" "dc=domain,dc=tld" Any help would be appreciated. Thank you, SS

1 0

about slapo totp
by Bastian Tweddell 09 Feb '23

09 Feb '23

Dear all, I am investigating if it is possible to use the TOTP overlay in the following concept: Many thanks for any - nis related data of users are in ldap - user ssh access to the system is pubkey only - after successful authentication also request TOTP via PAM call to slapd (only TOTP, no password) Does this make sense and can this be achieved? Thanks in advance, -- Bastian Tweddell Juelich Supercomputing Centre phone: +49 (2461) 61-6586 HPC in Neuroscience, HPS ------------------------------------------------------------------------------- ------------------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Dr. Ir. Pieter Jansens, Prof. Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ------------------------------------------------------------------------------- -------------------------------------------------------------------------------

2 7

Re: Trying to migrate from ldap 2.4.x to 2.6.x and having an issue.
by Matthew Goebel 09 Feb '23

09 Feb '23

Ah, I have a mix of suse stanzas and (ou=people) stanzas, I was removing both. Just removing the stanzas with suse references and reimporting the whole mess seems to work! :) I need to get someone else on my team to test some stuff since I've been staring at this too long now. Thanks, Matt On Wed, Feb 8, 2023 at 3:57 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Wednesday, February 8, 2023 3:10 PM -0500 Matthew Goebel > <mgoebel(a)emich.edu> wrote: > > > > > > > > > I used slapcat/slapdd > > > > > > The two boxes are using different backend databases so I don't think I > > can copy the data files? > > Right, heh. I forgot you were still on hdb/bdb. I'll try to get some > time > to read over the full older config. Can you confirm your slapcat export > contains an entry for the root of the DIT? It should be the first entry in > the file (ou=people,...) > > Thanks! > > --Quanah > > > > > -- Matthew Goebel : m <goebel(a)emunix.emich.edu>goebel(a)emich.edu : Unix Jockey @ EMU : Hail Eris Neo-Student, Net Lurker, Donut consumer, and procrastinating medher... "Always with the negative waves, Moriarty" - Oddball "Comfort the troubled, and trouble the comfortable." - Dietrich Bonhoeffer

1 0

Re: Trying to migrate from ldap 2.4.x to 2.6.x and having an issue.
by Matthew Goebel 08 Feb '23

08 Feb '23

I used slapcat/slapdd The two boxes are using different backend databases so I don't think I can copy the data files? Thanks, Matt On Wed, Feb 8, 2023 at 2:06 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Tuesday, February 7, 2023 4:56 PM -0500 Matthew Goebel > <mgoebel(a)emich.edu> wrote: > > > > > > > > > Config file attached ... > > Sorry I haven't had time to review the config yet, but a question popped > into my mind -- How did you migrate the data between the two instances? > I.e., did you copy the MDB file, or use slapcat/slapadd? > > Thanks! > > --Quanah > > > > -- Matthew Goebel : m <goebel(a)emunix.emich.edu>goebel(a)emich.edu : Unix Jockey @ EMU : Hail Eris Neo-Student, Net Lurker, Donut consumer, and procrastinating medher... "Always with the negative waves, Moriarty" - Oddball "Comfort the troubled, and trouble the comfortable." - Dietrich Bonhoeffer

2 1

Re: Trying to migrate from ldap 2.4.x to 2.6.x and having an issue.
by Matthew Goebel 08 Feb '23

08 Feb '23

Config file attached ... Thanks, Matt On Tue, Feb 7, 2023 at 4:46 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Tuesday, February 7, 2023 4:27 PM -0500 Matthew Goebel > <mgoebel(a)emich.edu> wrote: > > > > > > > > > I don't have anything on the old server from the actual config files ... > > > Use slapcat to export the config db in its entirety: > > slapcat -n 0 -F /path/to/slapd.d -l /tmp/slapd-conf.ldif > > Then redact passwords. > > --Quanah > > > > -- Matthew Goebel : m <goebel(a)emunix.emich.edu>goebel(a)emich.edu : Unix Jockey @ EMU : Hail Eris Neo-Student, Net Lurker, Donut consumer, and procrastinating medher... "Always with the negative waves, Moriarty" - Oddball "Comfort the troubled, and trouble the comfortable." - Dietrich Bonhoeffer

2 1

Re: Trying to migrate from ldap 2.4.x to 2.6.x and having an issue.
by Matthew Goebel 07 Feb '23

07 Feb '23

I don't have anything on the old server from the actual config files ... ---------- :: olcDatabase={1}hdb.ldif # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 93f87e7c dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: ou=people,o=emich.edu olcAccess: {0}to attrs=userPassword by self write by * auth olcAccess: {1}to attrs=shadowLastChange by self write by * read olcAccess: {2}to attrs=userPKCS12 by self read by * none olcAccess: {3}to * by * read olcRootDN: cn=Administrator,ou=people,o=emich.edu olcDbCacheSize: 10000 olcDbCheckpoint: 1024 5 olcDbConfig: {0}set_cachesize 0 15000000 1 olcDbConfig: {1}set_lg_regionmax 262144 olcDbConfig: {2}set_lg_bsize 2097152 olcDbConfig: {3}set_flags DB_LOG_AUTOREMOVE olcDbConfig: {4}set_lk_max_locks 30000 olcDbConfig: {5}set_lk_max_objects 30000 olcDbIDLcacheSize: 30000 olcDbIndex: objectclass eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: member eq olcDbIndex: memberUid eq olcDbIndex: mail eq olcDbIndex: cn eq,sub olcDbIndex: displayName eq,sub olcDbIndex: uid eq,sub olcDbIndex: sn eq,sub olcDbIndex: givenName eq,sub structuralObjectClass: olcHdbConfig entryUUID: b3baae2c-f8f6-1035-90eb-91daf978c9c3 creatorsName: cn=config createTimestamp: 20160817184650Z olcRootPW:: notapassword entryCSN: 20160919185226.957088Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20160919185226Z --------- :: olcDatabase={-1}frontend.ldif # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 3a908355 dn: olcDatabase={-1}frontend objectClass: olcDatabaseConfig olcDatabase: {-1}frontend olcAccess: {0}to dn.base="" by * read olcAccess: {1}to dn.base="cn=Subschema" by * read structuralObjectClass: olcDatabaseConfig entryUUID: b3baa54e-f8f6-1035-90e9-91daf978c9c3 creatorsName: cn=config createTimestamp: 20160817184650Z entryCSN: 20160817184650.166168Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20160817184650Z Thanks, Matt On Tue, Feb 7, 2023 at 3:15 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Tuesday, February 7, 2023 10:55 AM -0500 Matthew Goebel > <mgoebel(a)emich.edu> wrote: > > > dn: olcDatabase=mdb,cn=config > > > > objectClass: olcDatabaseConfig > > > > objectClass: olcMdbConfig > > > > olcDatabase: mdb > > > > olcDbMaxSize: 1073741824 > > > > olcSuffix: dc=my-domain,dc=com > > > > olcRootDN: cn=Manager,dc=my-domain,dc=com > > > ># Cleartext passwords, especially for the rootdn, should > > > ># be avoided. See slappasswd(8) and slapd-config(5) for details. > > > ># Use of strong authentication encouraged. > > > > olcRootPW: PASSWORDNOTHERE > > > ># The database directory MUST exist prior to running slapd AND > > > ># should only be accessible by the slapd and slap tools. > > > ># Mode 700 recommended. > > > > olcDbDirectory: /usr/local/var/openldap-data > > > ># Indices to maintain > > > > olcDbIndex: objectClass eq > > > You should likely delete the above database definion, unless you really > have a "dc=my-domain,dc=com" that you're serving. This just looks like > the > default one that's created by RH as an example. Note that this db doesn't > allow any access either. ;) > > > > > > dn: olcDatabase=mdb,cn=config > > > > objectClass: olcDatabaseConfig > > > > objectClass: olcMdbConfig > > > > olcDatabase: mdb > > > > olcDbDirectory: /var/lib/ldap > > > > olcSuffix: ou=people,o=emich.edu > > > > olcAccess: {0}to attrs=userPassword by self write by * auth > > This should most likely be "by self write by anonymous auth by * none" > > > olcAccess: {1}to attrs=shadowLastChange by self write by * read > > > > olcAccess: {2}to attrs=userPKCS12 by self read by * none > > > > olcAccess: {3}to * by * read > > > I'm curious what your ACL definitions were for your 2.4 config (all ACLs > including global). > > > > > ># olcDbConfig: {0}set_cachesize 0 15000000 1 > > > ># olcDbConfig: {1}set_lg_regionmax 262144 > > > ># olcDbConfig: {2}set_lg_bsize 2097152 > > > ># olcDbConfig: {3}set_flags DB_LOG_AUTOREMOVE > > > ># olcDbConfig: {4}set_lk_max_locks 30000 > > > ># olcDbConfig: {5}set_lk_max_objects 30000 > > > Delete the above 'olcDbConfig' lines. Those were for back-bdb/hdb which > doesn't exist in 2.5+ > > > -- Matthew Goebel : m <goebel(a)emunix.emich.edu>goebel(a)emich.edu : Unix Jockey @ EMU : Hail Eris Neo-Student, Net Lurker, Donut consumer, and procrastinating medher... "Always with the negative waves, Moriarty" - Oddball "Comfort the troubled, and trouble the comfortable." - Dietrich Bonhoeffer

2 1

Re: Trying to migrate from ldap 2.4.x to 2.6.x and having an issue.
by Matthew Goebel 07 Feb '23

07 Feb '23

Thanks for the version info, I have now compiled and installed 2.6.3. Here is my slapd.ldif with the password redacted ... # # See slapd-config(5) for details on configuration options. # This file should NOT be world readable. # dn: cn=config objectClass: olcGlobal cn: config # # # Define global ACLs to disable default read access. # olcArgsFile: /usr/local/var/run/slapd.args olcPidFile: /usr/local/var/run/slapd.pid # # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #olcReferral: ldap://root.openldap.org # # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 64-bit encryption for simple bind #olcSecurity: ssf=1 update_ssf=112 simple_bind=64 # # Load dynamic backend modules: # dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulepath: /usr/local/libexec/openldap olcModuleload: back_mdb.la #olcModuleload: back_ldap.la #olcModuleload: back_passwd.la dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema include: file:///usr/local/etc/openldap/schema/core.ldif #moose include: file:///usr/local/etc/openldap/schema/cosine.ldif include: file:///usr/local/etc/openldap/schema/nis.ldif include: file:///usr/local/etc/openldap/schema/inetorgperson.ldif # Frontend settings # dn: olcDatabase=frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcAccess: {0}to dn.base="" by * read olcAccess: {1}to dn.base="cn=Subschema" by * read olcDatabase: frontend # # Sample global access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # #olcAccess: to dn.base="" by * read #olcAccess: to dn.base="cn=Subschema" by * read #olcAccess: to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! # ####################################################################### # LMDB database definitions ####################################################################### # dn: olcDatabase=mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: mdb olcDbMaxSize: 1073741824 olcSuffix: dc=my-domain,dc=com olcRootDN: cn=Manager,dc=my-domain,dc=com # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd-config(5) for details. # Use of strong authentication encouraged. olcRootPW: PASSWORDNOTHERE # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. olcDbDirectory: /usr/local/var/openldap-data # Indices to maintain olcDbIndex: objectClass eq dn: olcDatabase=monitor,cn=config objectClass: olcDatabaseConfig olcDatabase: monitor olcRootDN: cn=config olcMonitoring: FALSE dn: olcDatabase=mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: mdb olcDbDirectory: /var/lib/ldap olcSuffix: ou=people,o=emich.edu olcAccess: {0}to attrs=userPassword by self write by * auth olcAccess: {1}to attrs=shadowLastChange by self write by * read olcAccess: {2}to attrs=userPKCS12 by self read by * none olcAccess: {3}to * by * read olcRootDN: cn=Administrator,ou=people,o=emich.edu olcDbCacheSize: 10000 olcDbCheckpoint: 1024 5 olcDbMaxSize: 1073741824 olcSizeLimit: 50000 #olcDbConfig: {0}set_cachesize 0 15000000 1 #olcDbConfig: {1}set_lg_regionmax 262144 #olcDbConfig: {2}set_lg_bsize 2097152 #olcDbConfig: {3}set_flags DB_LOG_AUTOREMOVE #olcDbConfig: {4}set_lk_max_locks 30000 #olcDbConfig: {5}set_lk_max_objects 30000 #olcDbIDLcacheSize: 30000 olcDbIndex: objectclass eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: member eq olcDbIndex: memberUid eq olcDbIndex: mail eq olcDbIndex: cn eq,sub olcDbIndex: displayName eq,sub olcDbIndex: uid eq,sub olcDbIndex: sn eq,sub olcDbIndex: givenName eq,sub structuralObjectClass: olcMdbConfig entryUUID: b3baae2c-f8f6-1035-90eb-91daf978c9c3 creatorsName: cn=config createTimestamp: 20160817184650Z olcRootPW:: PASSWORDNOTHERE entryCSN: 20160919185226.957088Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20160919185226Z Thanks, Matt On Tue, Feb 7, 2023 at 10:03 AM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Monday, February 6, 2023 4:58 PM -0500 Matthew Goebel > <mgoebel(a)emich.edu> wrote: > > directory8.emich.edu : redhat ES 8 : hand rolled from source code ldap > > > > [root@directory8.emich.edu:/root]# /usr/local/libexec/slapd -V > > > > @(#) $OpenLDAP: slapd 2.6.X (Nov 15 2022 16:59:29) $ > > That's the engineering branch. It's not advised to run development code > in > production. > > > I can't seem to do global anonymous searches? > > > > I don't understand ldap well enough to figure out what step or config > > > > I've missed. > > > > compile options used for openldap were > > > compile options should be irrelevant, this would be an ACL issue. You've > not provided any information about the ACLs the deployment uses. > > --Quanah > > > > -- Matthew Goebel : m <goebel(a)emunix.emich.edu>goebel(a)emich.edu : Unix Jockey @ EMU : Hail Eris Neo-Student, Net Lurker, Donut consumer, and procrastinating medher... "Always with the negative waves, Moriarty" - Oddball "Comfort the troubled, and trouble the comfortable." - Dietrich Bonhoeffer

2 1

Trying to migrate from ldap 2.4.x to 2.6.x and having an issue.
by Matthew Goebel 07 Feb '23

07 Feb '23

Hello, I am trying to migrate from directory.emich.edu : redhat ES 7 : redhat supplied ldap [root@directory.emich.edu:/etc/openldap]# /usr/sbin/slapd -V @(#) $OpenLDAP: slapd 2.4.44 (Jun 6 2020 17:06:42) $ mockbuild(a)x86-vm-25.build.eng.bos.redhat.com: /builddir/build/BUILD/openldap-2.4.44/openldap-2.4.44/servers/slapd to directory8.emich.edu : redhat ES 8 : hand rolled from source code ldap [root@directory8.emich.edu:/root]# /usr/local/libexec/slapd -V @(#) $OpenLDAP: slapd 2.6.X (Nov 15 2022 16:59:29) $ root(a)directory8.emich.edu: /home/src/openldap-OPENLDAP_REL_ENG_2_6/servers/slapd And everything seems to work except for one thing. I can't seem to do global anonymous searches? I don't understand ldap well enough to figure out what step or config I've missed. [root@directory8.emich.edu:/tmp]# ldapsearch -H "ldap://directory.emich.edu" -LLL -b "uid=mgoebel,ou=people,o=emich.edu" -x -s sub "(objectClass=*)" dn: uid=mgoebel,ou=people,o=emich.edu objectClass: top objectClass: person objectClass: inetOrgPerson objectClass: organizationalPerson uid: mgoebel [root@directory8.emich.edu:/tmp]# ldapsearch -H "ldap://directory8.emich.edu" -LLL -b "uid=mgoebel,ou=people,o=emich.edu" -x -s sub "(objectClass=*)" dn: uid=mgoebel,ou=people,o=emich.edu objectClass: top objectClass: person objectClass: inetOrgPerson objectClass: organizationalPerson uid: mgoebel [root@directory8.emich.edu:/tmp]# ldapsearch -H "ldap://directory.emich.edu" -LLL -b "ou=people,o=emich.edu" -x -s sub "(objectClass=*)" returns every record with objectClass set [root@directory8.emich.edu:/tmp]# ldapsearch -H "ldap://directory8.emich.edu" -LLL -b "ou=people,o=emich.edu" -x -s sub "(objectClass=*)" No such object (32) compile options used for openldap were ./configure \ --prefix=/usr/local \ --disable-ipv6 \ --with-kerberos \ --enable-monitor \ --enable-dynamic \ --enable-phonetic \ --enable-slapd \ --enable-spasswd \ --enable-rlookups \ --enable-hdb \ --enable-dyngroup=yes \ --enable-proxycache=yes \ --enable-bdb \ --enable-crypt \ --with-cyrus-sasl=yes \ --with-tls Thanks, Matt -- Matthew Goebel : m <goebel(a)emunix.emich.edu>goebel(a)emich.edu : Unix Jockey @ EMU : Hail Eris Neo-Student, Net Lurker, Donut consumer, and procrastinating medher... "Always with the negative waves, Moriarty" - Oddball "Comfort the troubled, and trouble the comfortable." - Dietrich Bonhoeffer

2 1

Re: RE26 testing call (2.6.4) #3
by Simon Pichugin 07 Feb '23

07 Feb '23

Builds and tests cleanly on Fedora 38 (Rawhide). On Tue, Jan 31, 2023 at 9:59 AM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > This is the third testing call for OpenLDAP 2.6.4. Depending on the > results, this may be the final testing call. > > Generally, get the code for RE26: > > < > https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o… > > > > Extract, configure, and build. > > Execute the test suite (via make test) after it is built. Optionally, cd > tests && make its to run through the regression suite. > > Thanks! > > OpenLDAP 2.6.4 Engineering > Fixed client tools to remove 'h' and 'p' options (ITS#9917,ITS#8618) > Fixed ldapsearch memory leak with paged results (ITS#9860) > Fixed libldap ldif_open_urlto check for failure (ITS#9904) > Fixed libldap ldap_url_parsehosts check for failure (ITS#9904) > Fixed liblunicode UTF8bvnormalize buffer size (ITS#9955) > Fixed lloadd memory leaks (ITS#9907) > Fixed lloadd shutdown code to protect memory correctly (ITS#9913) > Fixed lloadd race in epoch.c (ITS#9947) > Fixed lloadd potential deadlock with cn=monitor (ITS#9951) > Fixed lloadd to keep listener base around when not active (ITS#9984) > Fixed lloadd object reclamation sequencing (ITS#9983) > Fixed slapd memory leak with olcAuthIDRewrite (ITS#6035) > Fixed slapd free of redundant cmdline option (ITS#9912) > Fixed slapd transactions extended operations cleanup after write > (ITS#9892) > Fixed slapd deadlock with replicated cn=config (ITS#9930,ITS#8102) > Fixed slapd connection close logic (ITS#9991) > Fixed slapd bconfig locking of cn=config entries (ITS#9045) > Fixed slapd-mdb max number of index databases to 256 (ITS#9895) > Fixed slapd-mdb to always release entries from ADD operations > (ITS#9942) > Fixed slapd-mdb to fully init empty DN in tool_entry_get (ITS#9940) > Fixed slapd-monitor memory leaks with lloadd (ITS#9906) > Fixed slapd-monitor to free remembered cookies (ITS#9339) > Fixed slapo-accesslog reqStart ordering matching rule (ITS#9880) > Fixed slapo-deref memory leak (ITS#9924) > Fixed slapo-dynlist to ignore irrelevant objectClasses (ITS#9897) > Fixed slapo-dynlist to avoid unnecessary searches (ITS#9929) > Fixed slapo-dynlist to mark internal searches as such (ITS#9960) > Fixed slapo-pcache crash in consistency_check (ITS#9966) > Fixed slapo-remoteauth memory leaks (ITS#9438) > Fixed slapo-rwm memory leaks (ITS#9817) > Build Environment > Fixed ancient DOS related ifdef checks (ITS#9925) > Fixed build process to not use gmake specific features (ITS#9894) > Fixed source tree to remove symlinks (ITS#9926) > Fixed slapo-otp testdir creation (ITS#9437) > Fixed slapd-tester memory leak (ITS#9908) > Fixed usage of non-standard C syntax (ITS#9898, ITS#9899, ITS#9901) > Fixed usage of bashism (ITS#9900) > Fixed test suite portability (ITS#9931) > Documentation > Fixed ldap_bind(3) to document ber_bvfree in ldap_sasl_bind > (ITS#9976) > Fixed slapo-asyncmeta(5) to clarify scheduling for target > connections (ITS#9941) > Fixed slapo-dynlist(5) to clarify configuration settings (ITS#9957) > Fixed slapo-unique(5) to clarify when quoting should be used > (ITS#9915) > Minor cleanup > ITS#9935 > ITS#9336 > ITS#9337 > ITS#9985 > > Regards, > Quanah > >

1 0

Symas OpenLDAP RE25 and RE26 test packages available
by Shawn McKinney 03 Feb '23

03 Feb '23

For those who want a preview of upcoming 2.5.14 and 2.6.4, we have uploaded packages into our testing repo. To try them, follow these instructions: https://repo.symas.com/ Substituting ’testing’ for ‘release’ when setting up the package repo. For example, RHEL9 RE26 testing packages: ``` wget -q https://repo.symas.com/configs/SOLDAP/rhel9/testing26.repo -O /etc/yum.repos.d/soldap-testing26.repo ``` Or, U20.04 RE25: ``` wget -q https://repo.symas.com/configs/SOLDAP/u20/testing25.list -O /etc/apt/sources.list.d/soldap-testing25.list ``` The following platforms are available: - RHEL7/8/9 - Debian 10/11 - Ubuntu 18.04/20.04/22.04 - SLES 15.3 Notes: - RHEL9 and Ubuntu 22.04 packages are not yet in the release repo. Both will be there after this release. - Symas packages are not supported by the OpenLDAP project. - Issues directed to support(a)symas.com — Shawn

2 2

Setting acl on cn=accesslog (accesslog overlay)
by Simon Kainz 03 Feb '23

03 Feb '23

Hello, i am looking for a way to set an ACL entry for cn=accesslog, which is where i am logging the slapo-accesslog overlay entries to. I tried to set set it with the following: dn: olcDatabase{1}mdb,cn=config changeType: modify add: olcAccess alcAccess: to db.base="cn=accesslog" by dn.base="cn=ldap_cleanup,o=<....>" read by * break This operation works, and i see the intry in my slapd config. I am still unable to see entries from cn=accesslog. Regards, Simon

3 3

Requesting information about libraries/ldap_r
by jjrobert＠lexmark.com 01 Feb '23

01 Feb '23

We are upgrading our stack from using openldap 2.4.57 to 2.5.12 and one of our dependencies is missing lldap_r. I searched and only really found this, which gives me some idea of its purpose: https://marc.info/?l=openldap-devel&m=95218635611825 Is it simply gone now, or does it exist as a separate library? Is there any guidance on what to do if you were using it previously? Thanks, -Jeff

2 1

RE26 testing call (2.6.4) #3
by Quanah Gibson-Mount 01 Feb '23

01 Feb '23

This is the third testing call for OpenLDAP 2.6.4. Depending on the results, this may be the final testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.6.4 Engineering Fixed client tools to remove 'h' and 'p' options (ITS#9917,ITS#8618) Fixed ldapsearch memory leak with paged results (ITS#9860) Fixed libldap ldif_open_urlto check for failure (ITS#9904) Fixed libldap ldap_url_parsehosts check for failure (ITS#9904) Fixed liblunicode UTF8bvnormalize buffer size (ITS#9955) Fixed lloadd memory leaks (ITS#9907) Fixed lloadd shutdown code to protect memory correctly (ITS#9913) Fixed lloadd race in epoch.c (ITS#9947) Fixed lloadd potential deadlock with cn=monitor (ITS#9951) Fixed lloadd to keep listener base around when not active (ITS#9984) Fixed lloadd object reclamation sequencing (ITS#9983) Fixed slapd memory leak with olcAuthIDRewrite (ITS#6035) Fixed slapd free of redundant cmdline option (ITS#9912) Fixed slapd transactions extended operations cleanup after write (ITS#9892) Fixed slapd deadlock with replicated cn=config (ITS#9930,ITS#8102) Fixed slapd connection close logic (ITS#9991) Fixed slapd bconfig locking of cn=config entries (ITS#9045) Fixed slapd-mdb max number of index databases to 256 (ITS#9895) Fixed slapd-mdb to always release entries from ADD operations (ITS#9942) Fixed slapd-mdb to fully init empty DN in tool_entry_get (ITS#9940) Fixed slapd-monitor memory leaks with lloadd (ITS#9906) Fixed slapd-monitor to free remembered cookies (ITS#9339) Fixed slapo-accesslog reqStart ordering matching rule (ITS#9880) Fixed slapo-deref memory leak (ITS#9924) Fixed slapo-dynlist to ignore irrelevant objectClasses (ITS#9897) Fixed slapo-dynlist to avoid unnecessary searches (ITS#9929) Fixed slapo-dynlist to mark internal searches as such (ITS#9960) Fixed slapo-pcache crash in consistency_check (ITS#9966) Fixed slapo-remoteauth memory leaks (ITS#9438) Fixed slapo-rwm memory leaks (ITS#9817) Build Environment Fixed ancient DOS related ifdef checks (ITS#9925) Fixed build process to not use gmake specific features (ITS#9894) Fixed source tree to remove symlinks (ITS#9926) Fixed slapo-otp testdir creation (ITS#9437) Fixed slapd-tester memory leak (ITS#9908) Fixed usage of non-standard C syntax (ITS#9898, ITS#9899, ITS#9901) Fixed usage of bashism (ITS#9900) Fixed test suite portability (ITS#9931) Documentation Fixed ldap_bind(3) to document ber_bvfree in ldap_sasl_bind (ITS#9976) Fixed slapo-asyncmeta(5) to clarify scheduling for target connections (ITS#9941) Fixed slapo-dynlist(5) to clarify configuration settings (ITS#9957) Fixed slapo-unique(5) to clarify when quoting should be used (ITS#9915) Minor cleanup ITS#9935 ITS#9336 ITS#9337 ITS#9985 Regards, Quanah

2 1

RE25 testing call (2.5.14) #3
by Quanah Gibson-Mount 31 Jan '23

31 Jan '23

This is the third testing call for OpenLDAP 2.5.14. Depending on the results, this may be the final testing call. Generally, get the code for RE25: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_5/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.5.14 Engineering Fixed client tools to remove 'h' and 'p' options (ITS#9917,ITS#8618) Fixed ldapsearch memory leak with paged results (ITS#9860) Fixed libldap ldif_open_urlto check for failure (ITS#9904) Fixed libldap ldap_url_parsehosts check for failure (ITS#9904) Fixed liblunicode UTF8bvnormalize buffer size (ITS#9955) Fixed lloadd race in epoch.c (ITS#9947) Fixed lloadd to keep listener base around when not active (ITS#9984) Fixed lloadd object reclamation sequencing (ITS#9983) Fixed slapd memory leak with olcAuthIDRewrite (ITS#6035) Fixed slapd transactions extended operations cleanup after write (ITS#9892) Fixed slapd deadlock with replicated cn=config (ITS#9930,ITS#8102) Fixed slapd connection close logic (ITS#9991) Fixed slapd bconfig locking of cn=config entries (ITS#9045) Fixed slapd-mdb max number of index databases to 256 (ITS#9895) Fixed slapd-mdb to always release entries from ADD operations (ITS#9942) Fixed slapd-mdb to fully init empty DN in tool_entry_get (ITS#9940) Fixed slapd-monitor to free remembered cookies (ITS#9339) Fixed slapo-accesslog reqStart ordering matching rule (ITS#9880) Fixed slapo-deref memory leak (ITS#9924) Fixed slapo-dynlist to ignore irrelevant objectClasses (ITS#9897) Fixed slapo-dynlist to avoid unnecessary searches (ITS#9929) Fixed slapo-dynlist to mark internal searches as such (ITS#9960) Fixed slapo-pcache crash in consistency_check (ITS#9966) Fixed slapo-remoteauth memory leaks (ITS#9438) Build Environment Fixed ancient DOS related ifdef checks (ITS#9925) Fixed build process to not use gmake specific features (ITS#9894) Fixed source tree to remove symlinks (ITS#9926) Fixed slapo-otp testdir creation (ITS#9437) Fixed slapd-tester memory leak (ITS#9908) Fixed usage of non-standard C syntax (ITS#9898, ITS#9899, ITS#9901) Fixed usage of bashism (ITS#9900) Fixed test suite portability (ITS#9931) Documentation Fixed ldap_bind(3) to document ber_bvfree in ldap_sasl_bind (ITS#9976) Fixed slapo-asyncmeta(5) to clarify scheduling for target connections (ITS#9941) Fixed slapo-dynlist(5) to clarify configuration settings (ITS#9957) Fixed slapo-unique(5) to clarify when quoting should be used (ITS#9915) Minor cleanup ITS#9935 ITS#9336 ITS#9337 ITS#9985 Regards, Quanah

1 0

How to retrieve invalid CA certificate error upon ldap over TLS connection using openldap PAI
by tishamol＠gmail.com 27 Jan '23

27 Jan '23

Hi, How can i get an error specific to invalid CA certificate for an ldaps connection(LDAP over TLS)? Our flow is like this 1:ldap_initialize() 2:ldap_sasl_bind_s() But even if i import an invalid CA certificate on ldap client to verify the server certificate , i don't get any error specific to TLS handshake fail. ldap_sasl_bind_s()() always return -1. Can you suggest someway to fetch this error from openldap? Thanks, Smitha

1 1

VRF support in openldap
by tishamol＠gmail.com 27 Jan '23

27 Jan '23

Hi, I would like to know is there any support for passing vrf-id to openldap library ? Thanks, Smitha

2 5

Any chance to include ITS#9990 fix in 2.5.14?
by Kartik Subbarao 27 Jan '23

27 Jan '23

I ran into a passwd exop overlay problem this week when upgrading from 2.4.57 to 2.5.13 and was able to track it down (ITS#9990). Fortunately the fix is very simple, just revert the changes to passwd.c made in ITS#8698. I noticed the testing call for 2.5.14 and wanted to ask if it might be possible to include this fix in that release. Totally understood if you guys need to get this out the door as soon as possible. just figured I'd ask to see if we can get this fix included :-) Thanks, -Kartik

2 1

RE25 testing call (2.5.14) #2
by Quanah Gibson-Mount 27 Jan '23

27 Jan '23

This is the second testing call for OpenLDAP 2.5.14. Depending on the results, this may be the final testing call. Generally, get the code for RE25: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_5/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.5.14 Engineering Fixed client tools to remove 'h' and 'p' options (ITS#9917,ITS#8618) Fixed ldapsearch memory leak with paged results (ITS#9860) Fixed libldap ldif_open_urlto check for failure (ITS#9904) Fixed libldap ldap_url_parsehosts check for failure (ITS#9904) Fixed liblunicode UTF8bvnormalize buffer size (ITS#9955) Fixed lloadd race in epoch.c (ITS#9947) Fixed lloadd to keep listener base around when not active (ITS#9984) Fixed lloadd object reclamation sequencing (ITS#9983) Fixed slapd memory leak with olcAuthIDRewrite (ITS#6035) Fixed slapd transactions extended operations cleanup after write (ITS#9892) Fixed slapd deadlock with replicated cn=config (ITS#9930) Fixed slapd-mdb max number of index databases to 256 (ITS#9895) Fixed slapd-mdb to always release entries from ADD operations (ITS#9942) Fixed slapd-mdb to fully init empty DN in tool_entry_get (ITS#9940) Fixed slapd-monitor to free remembered cookies (ITS#9339) Fixed slapo-accesslog reqStart ordering matching rule (ITS#9880) Fixed slapo-deref memory leak (ITS#9924) Fixed slapo-dynlist to ignore irrelevant objectClasses (ITS#9897) Fixed slapo-dynlist to avoid unnecessary searches (ITS#9929) Fixed slapo-dynlist to mark internal searches as such (ITS#9960) Fixed slapo-pcache crash in consistency_check (ITS#9966) Fixed slapo-remoteauth memory leaks (ITS#9438) Build Environment Fixed ancient DOS related ifdef checks (ITS#9925) Fixed build process to not use gmake specific features (ITS#9894) Fixed source tree to remove symlinks (ITS#9926) Fixed slapo-otp testdir creation (ITS#9437) Fixed slapd-tester memory leak (ITS#9908) Fixed usage of non-standard C syntax (ITS#9898, ITS#9899, ITS#9901) Fixed usage of bashism (ITS#9900) Fixed test suite portability (ITS#9931) Documentation Fixed ldap_bind(3) to document ber_bvfree in ldap_sasl_bind (ITS#9976) Fixed slapo-asyncmeta(5) to clarify scheduling for target connections (ITS#9941) Fixed slapo-dynlist(5) to clarify configuration settings (ITS#9957) Fixed slapo-unique(5) to clarify when quoting should be used (ITS#9915) Minor cleanup ITS#9935 ITS#9336 ITS#9337 Regards, Quanah

2 1

"container" structural class
by Timothy Stonis 26 Jan '23

26 Jan '23

Hi All, I’ve searched the internet, but can’t find any info, so sorry in advance if this is a basic question… I’m trying to setup a “standard” DIT in an OpenLDAP 2.6.3 deployment. I checked out my existing Active Directory deployment and also an old macOS Server implementation, and they both make heavy use of the “container” structural class. For example, users are in cn=users,dc=…,dc=… which is objectClass container. I see this class is defined in the msuser schema, but in 2.6.3 it’s definition is commented out in the msuser.schema file. Can anyone help shed some light on why this is the case and maybe a pointer to what a modern best practices DIT might look like? Thanks in advance Tim

4 3

LDAP Proxy (meta type)
by bourguijl＠gmail.com 25 Jan '23

25 Jan '23

Dears, I tried to configure a proxy ldap type (meta) but without success as I get following error message when I try to start it : 63d13d3c.03f49ea0 0x7f2e4ff3b1c0 backend_startup_one: starting "o=mobistar.be" 63d13d3c.03f4ab38 0x7f2e4ff3b1c0 meta_back_db_open: no targets defined 63d13d3c.03f53e41 0x7f2e4ff3b1c0 backend_startup_one (type=meta, suffix="o=mobistar.be"): bi_db_open failed! (1) Here is my configuration : dn: olcDatabase={2}meta objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {2}meta olcSuffix: o=mobistar.be olcDbURI: "ldap://acccorpldapproxym1.nonprod.priv.orange.be:389/ou=staff,o=mobistar.be" olcLastMod: FALSE olcReadOnly: TRUE olcRootDN: cn=directory manager,o=mobistar.be olcRootPW:: e1NTSEF9aFVwQ2t0RHdOeHJDZHJ3UHA2bkc2dEVHdFJRQzFwWk8= structuralObjectClass: olcMdbConfig To be sure it's not a Firewall issue, I started the target on the same server but no luck, it doesn't start. What can be my misconfiguration ? Thx for help, Jean-Luc.

1 0

RE26 testing call (2.6.4) #2
by Quanah Gibson-Mount 23 Jan '23

23 Jan '23

This is the second testing call for OpenLDAP 2.6.4. Depending on the results, this may be the final testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.6.4 Engineering Fixed client tools to remove 'h' and 'p' options (ITS#9917,ITS#8618) Fixed ldapsearch memory leak with paged results (ITS#9860) Fixed libldap ldif_open_urlto check for failure (ITS#9904) Fixed libldap ldap_url_parsehosts check for failure (ITS#9904) Fixed liblunicode UTF8bvnormalize buffer size (ITS#9955) Fixed lloadd memory leaks (ITS#9907) Fixed lloadd shutdown code to protect memory correctly (ITS#9913) Fixed lloadd race in epoch.c (ITS#9947) Fixed lloadd potential deadlock with cn=monitor (ITS#9951) Fixed lloadd to keep listener base around when not active (ITS#9984) Fixed lloadd object reclamation sequencing (ITS#9983) Fixed slapd memory leak with olcAuthIDRewrite (ITS#6035) Fixed slapd free of redundant cmdline option (ITS#9912) Fixed slapd transactions extended operations cleanup after write (ITS#9892) Fixed slapd deadlock with replicated cn=config (ITS#9930) Fixed slapd bconfig locking of cn=config entries (ITS#9045) Fixed slapd-mdb max number of index databases to 256 (ITS#9895) Fixed slapd-mdb to always release entries from ADD operations (ITS#9942) Fixed slapd-mdb to fully init empty DN in tool_entry_get (ITS#9940) Fixed slapd-monitor memory leaks with lloadd (ITS#9906) Fixed slapd-monitor to free remembered cookies (ITS#9339) Fixed slapo-accesslog reqStart ordering matching rule (ITS#9880) Fixed slapo-deref memory leak (ITS#9924) Fixed slapo-dynlist to ignore irrelevant objectClasses (ITS#9897) Fixed slapo-dynlist to avoid unnecessary searches (ITS#9929) Fixed slapo-dynlist to mark internal searches as such (ITS#9960) Fixed slapo-pcache crash in consistency_check (ITS#9966) Fixed slapo-remoteauth memory leaks (ITS#9438) Fixed slapo-rwm memory leaks (ITS#9817) Build Environment Fixed ancient DOS related ifdef checks (ITS#9925) Fixed build process to not use gmake specific features (ITS#9894) Fixed source tree to remove symlinks (ITS#9926) Fixed slapo-otp testdir creation (ITS#9437) Fixed slapd-tester memory leak (ITS#9908) Fixed usage of non-standard C syntax (ITS#9898, ITS#9899, ITS#9901) Fixed usage of bashism (ITS#9900) Fixed test suite portability (ITS#9931) Documentation Fixed ldap_bind(3) to document ber_bvfree in ldap_sasl_bind (ITS#9976) Fixed slapo-asyncmeta(5) to clarify scheduling for target connections (ITS#9941) Fixed slapo-dynlist(5) to clarify configuration settings (ITS#9957) Fixed slapo-unique(5) to clarify when quoting should be used (ITS#9915) Minor cleanup ITS#9935 ITS#9336 ITS#9337 Regards, Quanah

2 1

Re: RE26 testing call (2.6.4) #2
by Jean-Luc Bourguignon 23 Jan '23

23 Jan '23

Hello Quanah, Extract, configure, and build. make test make its were OK on Red Hat Enterprise Linux release 8.6 (Ootpa) Brgds, Jean-Luc. On Thu, Jan 19, 2023 at 9:29 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > This is the second testing call for OpenLDAP 2.6.4. Depending on the > results, this may be the final testing call. > > Generally, get the code for RE26: > > < > https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o… > > > > Extract, configure, and build. > > Execute the test suite (via make test) after it is built. Optionally, cd > tests && make its to run through the regression suite. > > Thanks! > > OpenLDAP 2.6.4 Engineering > Fixed client tools to remove 'h' and 'p' options (ITS#9917,ITS#8618) > Fixed ldapsearch memory leak with paged results (ITS#9860) > Fixed libldap ldif_open_urlto check for failure (ITS#9904) > Fixed libldap ldap_url_parsehosts check for failure (ITS#9904) > Fixed liblunicode UTF8bvnormalize buffer size (ITS#9955) > Fixed lloadd memory leaks (ITS#9907) > Fixed lloadd shutdown code to protect memory correctly (ITS#9913) > Fixed lloadd race in epoch.c (ITS#9947) > Fixed lloadd potential deadlock with cn=monitor (ITS#9951) > Fixed lloadd to keep listener base around when not active (ITS#9984) > Fixed lloadd object reclamation sequencing (ITS#9983) > Fixed slapd memory leak with olcAuthIDRewrite (ITS#6035) > Fixed slapd free of redundant cmdline option (ITS#9912) > Fixed slapd transactions extended operations cleanup after write > (ITS#9892) > Fixed slapd deadlock with replicated cn=config (ITS#9930) > Fixed slapd bconfig locking of cn=config entries (ITS#9045) > Fixed slapd-mdb max number of index databases to 256 (ITS#9895) > Fixed slapd-mdb to always release entries from ADD operations > (ITS#9942) > Fixed slapd-mdb to fully init empty DN in tool_entry_get (ITS#9940) > Fixed slapd-monitor memory leaks with lloadd (ITS#9906) > Fixed slapd-monitor to free remembered cookies (ITS#9339) > Fixed slapo-accesslog reqStart ordering matching rule (ITS#9880) > Fixed slapo-deref memory leak (ITS#9924) > Fixed slapo-dynlist to ignore irrelevant objectClasses (ITS#9897) > Fixed slapo-dynlist to avoid unnecessary searches (ITS#9929) > Fixed slapo-dynlist to mark internal searches as such (ITS#9960) > Fixed slapo-pcache crash in consistency_check (ITS#9966) > Fixed slapo-remoteauth memory leaks (ITS#9438) > Fixed slapo-rwm memory leaks (ITS#9817) > Build Environment > Fixed ancient DOS related ifdef checks (ITS#9925) > Fixed build process to not use gmake specific features (ITS#9894) > Fixed source tree to remove symlinks (ITS#9926) > Fixed slapo-otp testdir creation (ITS#9437) > Fixed slapd-tester memory leak (ITS#9908) > Fixed usage of non-standard C syntax (ITS#9898, ITS#9899, ITS#9901) > Fixed usage of bashism (ITS#9900) > Fixed test suite portability (ITS#9931) > Documentation > Fixed ldap_bind(3) to document ber_bvfree in ldap_sasl_bind > (ITS#9976) > Fixed slapo-asyncmeta(5) to clarify scheduling for target > connections (ITS#9941) > Fixed slapo-dynlist(5) to clarify configuration settings (ITS#9957) > Fixed slapo-unique(5) to clarify when quoting should be used > (ITS#9915) > Minor cleanup > ITS#9935 > ITS#9336 > ITS#9337 > > Regards, > Quanah >

1 0

Help moving from old server with bdb, etc.
by Chandler Sobel-Sorenson 22 Jan '23

22 Jan '23

Hi all, I'm trying to move our LDAP from an old CentOS 6 server to new Debian 11 server, but I'm running into the problem importing the config on the new server with slapadd: 63cc2422 <= str2entry: str2ad(olcDbCacheSize): attribute type undefined slapadd: could not parse entry (line=2076) I read that it's because of BDB being removed and no longer supported. What should I do, then? I admit LDAP is an area I practically know nothing about, so I'll appreciate your patience. This instance has been in place before I started my position over 6.5 years ago! It's been running great, but the server it's running on is also getting old and used for intense computation still at times, so I'm trying to be proactive and separate the LDAP service off to another server that is newer, that I can keep updated. The current, old server is running: @(#) $OpenLDAP: slapd 2.4.40 (Mar 22 2017 06:29:21) $ mockbuild@c1bm.rdu2.centos.org:/builddir/build/BUILD/openldap-2.4.40/openldap-2.4.40/build-servers/servers/slapd Included static backends: config ldif monitor bdb hdb ldap mdb meta null passwd relay shell sock and new server is running: @(#) $OpenLDAP: slapd 2.4.57+dfsg-3+deb11u1 (May 14 2022 18:32:57) $ Debian OpenLDAP Maintainers <pkg-openldap-devel(a)lists.alioth.debian.org> Included static backends: config ldif On the old server, I just ran: # cd /tmp # slapcat -n 0 -l config.ldif 63cc1841 PROXIED attributeDescription "DC" inserted. # slapcat -n 1 -l user.ldif 63cc1943 PROXIED attributeDescription "DC" inserted. # Then transferred the *.ldif to the new server and ran: # slapadd -n 0 -l /tmp/config.ldif This didn't work right off, so I adjusted the values of some parameters inside, such as: olcConfigFile, olcConfigDir, olcArgsFile, olcPidFile, olcTLSCertificateFile, olcTLSCertificateKeyFile. These were all in the `dn: cn=config`. After some more tries, figured I needed the -F option so am now using this command: # slapadd -n 0 -l /tmp/config.ldif -F /etc/ldap/slapd.d 63cc1f0f PROXIED attributeDescription "DC" inserted. 63cc1f0f <= str2entry: str2ad(olcDbCacheSize): attribute type undefined slapadd: could not parse entry (line=2076) _################### 99.05% eta none elapsed none spd 13.5 M/s Closing DB... # which brings us to the present situation. So, let me know if you have any ideas of what I should do/try next! Best, Chandler -- The University of Arizona block 'A' logo. *Chandler Sobel-Sorenson* Systems Administrator, Senior Arizona Genomics Institute School of Plant Sciences, Research THE UNIVERSITY OF ARIZONA Thomas W. Keating Bioresearch Bldg. | Rm. 200A24 1657 E. Helen St. | Tucson, AZ 85721 Office: 520-626-9589 | Cell: 520-907-4352 chandler(a)genome.arizona.edu <mailto: chandler(a)genome.arizona.edu> Pronouns: he/him/his *www.genome.arizona.edu* <https://www.genome.arizona.edu/> Integrity, Compassion, Exploration, Adaptation, Inclusion, Determination <https://brand.arizona.edu/signature>

4 7

using SRV-records in syncrepl
by Stefan Kania 20 Jan '23

20 Jan '23

hi to all, is it somehow possible to finde the provider in "syncrepl" of a consumer via DNS SRV-records. If I have several providers with lloadd in front of it and the consumers are only contacting the loadbalancer, the it would be nice to use the SRV-Records of the DNS. I could then set up two loadbalancer with a different priority, so if one failed the consumer would switch to the second loadbalancer. Just an idea :-). Because using just one loadbalancer it will be a single point of failure. Thanks Stefan

5 10

Re: Slow Mod operations on LDAP
by Bhanush Mehta 20 Jan '23

20 Jan '23

Hi Quanah The current mdb data file is GB on disk. We are using XFS, we tried with ext2 and ext4, we saw the same behavior for slow mods. 2376455:/var/lib/ldap$ sudo du -sh data.mdb 11G data.mdb 2376455:/var/lib/ldap$ sudo du -s data.mdb 10519776 data.mdb The dump from slapcat is 200 MB approx. Whenever we add it to a new instance, it balloons up to 10 GB and then stays around the same size. local-backups$ du -sh ldapdump202301180000.ldif 204M ldapdump202301180000.ldif Can DB size be a reason for slow mods? And, how do we investigate the slow mod further? Regards Bhanush On Tue, Jan 17, 2023 at 10:53 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Monday, January 16, 2023 10:47 AM +0530 Bhanush Mehta > <bhanush.mehta(a)flipkart.com> wrote: > > > > > Hi Quanah, > > > > > > We see the same issue with 2.4.58 (compiled from source). > > > > > > I am able to debug that mod operations are fast on a fresh mdb, but after > > a certain number of operations the mdb size is going from 300 MB to 10 > > GB. > > Hello, > > Are you sure that the database is actually 10GB in size? Keep in mind that > back-mdb uses a sparse file, so the filesystem will often show the > database > as being the "size" of the MDB maxsize value, regardless of what the > actual > DB size is. > > You can use du -h "file.mdb" to see the actual filesize. > > For example, in a test system, I have: > > maxsize 1073741824 > > which is 1GB. > > > If we look at the output of ls: > > total 2704 > -rw------- 1 root root 1073741824 May 17 2022 data.mdb > > but the actual size on disk is: > > du -h data.mdb > 2.7M data.mdb > > Regards, > Quanah > > > > -- *-----------------------------------------------------------------------------------------* *This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee, you should not disseminate, distribute or copy this email. Please notify the sender immediately by email if you have received this email by mistake and delete this email from your system. If you are not the intended recipient, you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.***** **** *Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the organization. Any information on shares, debentures or similar instruments, recommended product pricing, valuations and the like are for information purposes only. It is not meant to be an instruction or recommendation, as the case may be, to buy or to sell securities, products, services nor an offer to buy or sell securities, products or services unless specifically stated to be so on behalf of the Flipkart group. Employees of the Flipkart group of companies are expressly required not to make defamatory statements and not to infringe or authorise any infringement of copyright or any other legal right by email communications. Any such communication is contrary to organizational policy and outside the scope of the employment of the individual concerned. The organization will not accept any liability in respect of such communication, and the employee responsible will be personally liable for any damages or other liability arising.***** **** *Our organization accepts no liability for the content of this email, or for the consequences of any actions taken on the basis of the information *provided,* unless that information is subsequently confirmed in writing. If you are not the intended recipient, you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.* _-----------------------------------------------------------------------------------------_

4 5

Re: Slow Mod operations on LDAP
by Bhanush Mehta 18 Jan '23

18 Jan '23

Hi Quanah, We have 80 GB RAM on the system and 300 GB SSD disk allocated for the directory. Regards Bhanush On Wed, Jan 18, 2023 at 7:20 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Wednesday, January 18, 2023 6:31 PM +0530 Bhanush Mehta > <bhanush.mehta(a)flipkart.com> wrote: > > > > > > > Hi Quanah > > > > > > The current mdb data file is GB on disk. We are using XFS, we tried with > > ext2 and ext4, we saw the same behavior for slow mods. > > > > 2376455:/var/lib/ldap$ sudo du -sh data.mdb > > 11G data.mdb > > 2376455:/var/lib/ldap$ sudo du -s data.mdb > > 10519776 data.mdb > > > > The dump from slapcat is 200 MB approx. Whenever we add it to a new > > instance, it balloons up to 10 GB and then stays around the same size. > > local-backups$ du -sh ldapdump202301180000.ldif204M > > ldapdump202301180000.ldif > > > > > > Can DB size be a reason for slow mods? And, how do we investigate the > > slow mod further? > > One is a flat text file export of the database (.ldif) > > The other is a set of binary data based off of the flat text file export, > but includes things such as indices. You cannot correlate the two size > wise. > > If your binary database after an import with slapadd -q is ~11GB, than > that's the "real" size of your database. > > How much memory do you have on the system you're using? > > I would note that it is not advised to use XFS with back-mdb. > > --Quanah > > > > -- *-----------------------------------------------------------------------------------------* *This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee, you should not disseminate, distribute or copy this email. Please notify the sender immediately by email if you have received this email by mistake and delete this email from your system. If you are not the intended recipient, you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.***** **** *Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the organization. Any information on shares, debentures or similar instruments, recommended product pricing, valuations and the like are for information purposes only. It is not meant to be an instruction or recommendation, as the case may be, to buy or to sell securities, products, services nor an offer to buy or sell securities, products or services unless specifically stated to be so on behalf of the Flipkart group. Employees of the Flipkart group of companies are expressly required not to make defamatory statements and not to infringe or authorise any infringement of copyright or any other legal right by email communications. Any such communication is contrary to organizational policy and outside the scope of the employment of the individual concerned. The organization will not accept any liability in respect of such communication, and the employee responsible will be personally liable for any damages or other liability arising.***** **** *Our organization accepts no liability for the content of this email, or for the consequences of any actions taken on the basis of the information *provided,* unless that information is subsequently confirmed in writing. If you are not the intended recipient, you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.* _-----------------------------------------------------------------------------------------_

2 1

questions on index_hash64
by Geert Hendrickx 18 Jan '23

18 Jan '23

Hi I have a few questions on the index_hash64 / olcIndexHash64 feature; > Use a 64 bit hash for indexing. The default is to use 32 bit hashes. > These hashes are used for equality and substring indexing. The 64 bit > version may be needed to avoid index collisions when the number of > indexed values exceeds ~64 million. (Note that substring indexing > generates multiple index values per actual attribute value.) Indices > generated with 32 bit hashes are incompatible with the 64 bit version, > and vice versa. Any existing databases must be fully reloaded when > changing this setting. This directive is only supported on 64 bit CPUs. What is the effect if hash collisions happen? Will slapd actually return incorrect results, or does it just need to perform extra work to discard false positives from an index search result? Since this feature only impacts indexes and not data, isn't "slapindex" enough to to regenerate indexes, instead of a full slapcat/slapadd ? Finally, is there some way to detect if a given data.mdb file uses 32- or 64-bit index hashes? I can load a "legacy" data.mdb in a server with index_hash64 enabled, and slapd does not complain, indexes are just broken. Thanks Geert

2 1

Q: incrementally adding LDIF entries using ldapadd
by Ulrich Windl 18 Jan '23

18 Jan '23

Hi! I'm working on a program that "mangles" existing LDIF files so that the LDAP server accepts them. So say 75% passed, 25% had errors (need additional fixes). I'm using ldapadd with "-c" (continue) and "-S skipped.ldif" (skipped entries) to add the input LDIF. The idea was to iterate over skipped.ldif until the file is empty, i.e.: make skipped.ldif the new input file for the next run of ldapadd. However "skipped.ldif" also contains entries that were skipped, because they had been imported (successfully) before ("ldap_add: Already exists (68)"). Is there an easy way to extract only those entries that were not added? Of course I could write a program that implements that logic, talking to the LDAP server directly, but if avoidable I'd save the time to write such a program. Regards, Ulrich

2 2

programming ldap clients
by Gustavo Rios 17 Jan '23

17 Jan '23

Hi folks! I would like to write a simple ldap client in ANSI C programming language, to perform some interactions with slapd, things very simple, like howto insert an attribute to a given entry or even how to remove it from the ldap database. May some one here provide any tips on documentation teaching howto to program for ldap ? Thanks a lot for your time and cooperation. Kind regards. -- The lion and the tiger may be more powerful, but the wolves do not perform in the circus

2 1

ldap clients
by Gustavo Rios 17 Jan '23

17 Jan '23

Hi folks, i am looking for a tutorial on how to write ldap clients using C language. May someone in this list give me a reference tutorial ? Thanks a lot for your time and cooperation. Best regards, Gustavo -- The lion and the tiger may be more powerful, but the wolves do not perform in the circus

2 1

Re: Slow Mod operations on LDAP
by Bhanush Mehta 17 Jan '23

17 Jan '23

Hi Quanah, We see the same issue with 2.4.58 (compiled from source). The most common operations are ('attr=authTimestamp', 3890) ('attr=pwdFailureTime', 713) ('attr=userPassword', 29) ('attr=memberuid', 22) ('attr=accountExpiryDate', 21) ('attr=pwdAccountLockedTime pwdFailureTime pwdFailureTime pwdAccountLockedTime', 20) ('attr=pwdAccountLockedTime pwdFailureTime pwdFailureTime', 16) ('dn="cn=DISABLED_USERS,ou=Groups,dc=org,dc=com"', 15) ('attr=member', 15) I am able to debug that mod operations are fast on a fresh mdb, but after a certain number of operations the mdb size is going from 300 MB to 10 GB. And, the time spent per operation is like 1-2 seconds for every mod, and 5-6 seconds when there are a large number of mods. We also use a group for disabling users, when running mod to add users to that group we are seeing all ldap binds and other mods slowing as well. We have sortvals enabled for all groups. We have the following indexes: olcDbIndex: objectClass eq olcDbIndex: entryCSN eq olcDbIndex: entryUUID eq olcDbIndex: uid eq olcDbIndex: uidNumber eq olcDbIndex: uniqueMember eq olcDbIndex: gidNumber eq olcDbIndex: displayName eq olcDbIndex: cn eq olcDbIndex: sn eq olcDbIndex: member eq Regards Bhanush On Mon, Jan 9, 2023 at 9:11 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Friday, December 23, 2022 9:06 PM +0530 Bhanush Mehta > <bhanush.mehta(a)flipkart.com> wrote: > > > > > Hi All, > > > > We are seeing very slow MOD operations on our ldap (250 MB data dump), > > while using mdb (data.mdb is 6.4 Gb). The average MOD operation is going > > to 8-9 seconds. > > We are seeing 1k disk ops and 6-7MB/s writes. The disk is 4096 IOPS Sata > > SSD, we have seen write speed to be 126 MB/s generally. > > > > The slapd version is slapd (May 14 2022 18:35:44). > > The above is not a valid version. At a guess you're using an OpenLDAP 2.4 > build from Debian, but you'd have to check your package manager to confirm. > > It would be helpful to know what the mod operations are doing (I.e., > adding > new attribute values to a multi-valued attribute that has a lot of values > already, etc) > > --Quanah > > > > -- *-----------------------------------------------------------------------------------------* *This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee, you should not disseminate, distribute or copy this email. Please notify the sender immediately by email if you have received this email by mistake and delete this email from your system. If you are not the intended recipient, you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.***** **** *Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the organization. Any information on shares, debentures or similar instruments, recommended product pricing, valuations and the like are for information purposes only. It is not meant to be an instruction or recommendation, as the case may be, to buy or to sell securities, products, services nor an offer to buy or sell securities, products or services unless specifically stated to be so on behalf of the Flipkart group. Employees of the Flipkart group of companies are expressly required not to make defamatory statements and not to infringe or authorise any infringement of copyright or any other legal right by email communications. Any such communication is contrary to organizational policy and outside the scope of the employment of the individual concerned. The organization will not accept any liability in respect of such communication, and the employee responsible will be personally liable for any damages or other liability arising.***** **** *Our organization accepts no liability for the content of this email, or for the consequences of any actions taken on the basis of the information *provided,* unless that information is subsequently confirmed in writing. If you are not the intended recipient, you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.* _-----------------------------------------------------------------------------------------_

2 1

Discovering certificate locations from libldap
by Norman Gray 17 Jan '23

17 Jan '23

Greetings. Should I be able to discover the (default) locations of SSL certificates, via the libldap library? This can be useful when debugging why cert checks are failing -- where is the library checking? (am I using the library I think I am...?!) Of course dtruss and co can help here. ldap_get_option with LDAP_OPT_X_TLS_CACERTDIR (and friends) looks like it should say this, but when I explore that, it appears to show only settings added with ldap_set_option, thus only settings overriding a default. And this appears to be confirmed in libraries/libldap/tls_o.c:tlso_ctx_init. That function hands over to SSL functions, and while in principle I could retrieve a TLS session context with LDAP_OPT_X_TLS_{,SSL_}CTX, there are clear warnings that I shouldn't be tinkering with this. The fact that I'm this deep in the code suggests that either (a) this is not supported, or (b) I'm looking in the wrong place. I could in principle use functions from the OpenSSL library, like X509_get_default_cert_dir_env(), but that requires me to know which SSL library the libldap library was linked against (and that it was indeed OpenSSL), which has its own complications. Also, if I'm confident I know that, I have other ways to confirm the cert directory. Best wishes, Norman -- Norman Gray : https://nxg.me.uk

1 0

dynlist vs memberof performance issues
by Mark Cairney 12 Jan '23

12 Jan '23

Hi, I've been out the LDAP loop for a bit but the recent discussion of the memberof overlay on 2.5 piqued my curiosity. Having upgraded a Dev box, removed the memberof elements from the database and replaced the memberof overlay with dynlist the queries appear to work as expected but are both a) slow and b) heavily CPU-intensive on the LDAP server. 2021-09-01T12:47:17.603513+01:00 bonsai.authorise-dev.is.ed.ac.uk slapd[30075]: conn=1019 fd=12 ACCEPT from IP=192.168.152.33:58738 (IP=129.215.17.9:636) 2021-09-01T12:47:17.687488+01:00 bonsai.authorise-dev.is.ed.ac.uk slapd[30075]: conn=1019 fd=12 TLS established tls_ssf=256 ssf=256 tls_proto=TLSv1.3 tls_cipher=TLS_AES_256_GCM_SHA384 2021-09-01T12:47:17.688032+01:00 bonsai.authorise-dev.is.ed.ac.uk slapd[30075]: conn=1019 op=0 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" 2021-09-01T12:47:17.688470+01:00 bonsai.authorise-dev.is.ed.ac.uk slapd[30075]: conn=1019 op=0 SRCH attr=supportedSASLMechanisms 2021-09-01T12:47:17.688878+01:00 bonsai.authorise-dev.is.ed.ac.uk slapd[30075]: conn=1019 op=0 SEARCH RESULT tag=101 err=0 qtime=0.000014 etime=0.000214 nentries=1 text= 2021-09-01T12:47:17.811279+01:00 bonsai.authorise-dev.is.ed.ac.uk slapd[30075]: conn=1019 op=1 BIND dn="" method=163 2021-09-01T12:47:17.819249+01:00 bonsai.authorise-dev.is.ed.ac.uk slapd[30075]: conn=1019 op=1 RESULT tag=97 err=14 qtime=0.000030 etime=0.009084 text=SASL(0): successful result: 2021-09-01T12:47:17.908889+01:00 bonsai.authorise-dev.is.ed.ac.uk slapd[30075]: conn=1019 op=2 BIND dn="" method=163 2021-09-01T12:47:17.909836+01:00 bonsai.authorise-dev.is.ed.ac.uk slapd[30075]: conn=1019 op=2 RESULT tag=97 err=14 qtime=0.000031 etime=0.000181 text=SASL(0): successful result: 2021-09-01T12:47:17.938839+01:00 bonsai.authorise-dev.is.ed.ac.uk slapd[30075]: conn=1019 op=3 BIND dn="" method=163 2021-09-01T12:47:17.939621+01:00 bonsai.authorise-dev.is.ed.ac.uk slapd[30075]: conn=1019 op=3 BIND authcid="mcairney(a)EASE.ED.AC.UK" authzid="mcairney(a)EASE.ED.AC.UK" 2021-09-01T12:47:17.940213+01:00 bonsai.authorise-dev.is.ed.ac.uk slapd[30075]: conn=1019 op=3 BIND dn="uid=mcairney,ou=people,ou=central,dc=authorise-dev,dc=ed,dc=ac,dc=uk" mech=GSSAPI bind_ssf=256 ssf=256 2021-09-01T12:47:17.940616+01:00 bonsai.authorise-dev.is.ed.ac.uk slapd[30075]: conn=1019 op=3 RESULT tag=97 err=0 qtime=0.000024 etime=0.000409 text= 2021-09-01T12:47:18.227342+01:00 bonsai.authorise-dev.is.ed.ac.uk slapd[30075]: conn=1019 op=4 SRCH base="dc=authorise-dev,dc=ed,dc=ac,dc=uk" scope=2 deref=0 filter="(uid=mcairney)" 2021-09-01T12:47:18.227703+01:00 bonsai.authorise-dev.is.ed.ac.uk slapd[30075]: conn=1019 op=4 SRCH attr=* + 2021-09-01T12:47:31.392255+01:00 bonsai.authorise-dev.is.ed.ac.uk slapd[30075]: conn=1019 op=5 UNBIND 2021-09-01T12:47:31.460705+01:00 bonsai.authorise-dev.is.ed.ac.uk slapd[30075]: conn=1019 op=4 SEARCH RESULT tag=101 err=0 qtime=0.000031 etime=13.233679 nentries=1 text= 2021-09-01T12:47:31.461098+01:00 bonsai.authorise-dev.is.ed.ac.uk slapd[30075]: conn=1019 fd=12 closed I'm guessing that as the values are computed that this will be heavier on the CPU but it seems a bit excessive? Has anyone else noticed any similar performance issues? This is a relatively low-specced DEV server (2 vCPUs, 4GB RAM) so I guess this could be a factor but there's no io waiting on the server and no swapping? The database is on a par in size with our Production service ( about 400K user objects with 1 group object per user and then about 80K actual groups of users) The config for the primary DB (ACLs and rootPW redacted) is: dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /opt/openldap/var/openldap-data/authorise olcSuffix: dc=authorise-dev,dc=ed,dc=ac,dc=uk olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 2 olcReadOnly: FALSE olcSecurity: ssf=1 olcSecurity: update_ssf=112 olcSecurity: simple_bind=64 olcSizeLimit: unlimited olcSyncUseSubentry: FALSE olcTimeLimit: unlimited olcMonitoring: TRUE olcDbEnvFlags: writemap olcDbEnvFlags: nometasync olcDbNoSync: FALSE olcDbIndex: objectClass eq olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq olcDbIndex: cn pres,eq,sub olcDbIndex: uid pres,eq,sub olcDbIndex: uidNumber pres,eq olcDbIndex: gidNumber pres,eq olcDbIndex: eduniType eq olcDbIndex: gecos pres,eq,sub olcDbIndex: eduniCategory eq olcDbIndex: mail pres,eq,sub olcDbIndex: eduniSchoolCode eq olcDbIndex: eduniIDStatus eq olcDbIndex: eduniCollegeCode eq olcDbIndex: eduniOrgCode eq olcDbIndex: memberOf pres,eq olcDbIndex: eduniLibraryBarcode pres,eq olcDbIndex: eduniOrganisation pres,eq,sub olcDbIndex: eduniServiceCode pres,eq olcDbIndex: krbName pres,eq olcDbIndex: eduPersonAffiliation pres,eq olcDbIndex: eduPersonEntitlement pres,eq olcDbIndex: sn pres,eq,sub olcDbIndex: eduniIdmsId pres,eq olcDbIndex: member pres,eq olcDbIndex: memberUid pres,eq olcDbIndex: eduniRefNo pres,eq olcDbIndex: eduniTitle pres,eq olcDbIndex: title pres,eq,sub olcDbIndex: eduniCardNumber pres,eq olcDbIndex: eduniYearOfStudy eq olcDbIndex: description pres,eq,sub olcDbIndex: givenName pres,eq,sub olcDbIndex: aliasedObjectName eq olcDbIndex: yubiKeyId pres,eq olcDbIndex: isMemberOf pres,eq olcDbIndex: hasMember pres,eq olcDbIndex: proxyAddresses pres,eq,sub olcDbMaxReaders: 96 olcDbMaxSize: 32212254720 olcDbMode: 0600 olcDbSearchStack: 16 structuralObjectClass: olcMdbConfig dn: olcOverlay={0}syncprov,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top objectClass: olcSyncProvConfig olcOverlay: {0}syncprov structuralObjectClass: olcSyncProvConfig dn: olcOverlay={1}accesslog,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: {1}accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogPurge: 02+00:00 00+04:00 olcAccessLogSuccess: TRUE structuralObjectClass: olcAccessLogConfig dn: olcOverlay={2}dynlist,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcDynListConfig olcOverlay: {2}dynlist olcDynListAttrSet: {0}groupOfURLs memberURL member+memberOf@groupOfNames structuralObjectClass: olcDynListConfig -- /**************************** Mark Cairney ITI Enterprise Services Information Services University of Edinburgh Tel: 0131 650 6565 Email: Mark.Cairney(a)ed.ac.uk *******************************/ The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336. Is e buidheann carthannais a th’ ann an Oilthigh Dhùn Èideann, clàraichte an Alba, àireamh clàraidh SC005336.

12 27

Queries regarding Openldap migration from 2.4.51 to 2.6.2
by Nagesh Nikavade (EXT-NSB) 11 Jan '23

11 Jan '23

Hi Team, We are migrating openldap from 2.4.51 to 2.6.2 and we have the following queries 1. What is the End of life date for 2.4.x series? 2. OpenLdap 2.6.x doesn't have BDB Data base Support but has MDB, but in our existing machines where 2.4.51 is installed. Our data is populated in ".BDB" files. So is there is any guide where and how our data will be migrated from .BDB format to .MDB format ? 3. There is a utility db_verify which verifies .BDB files which is not working for .MDB files. What is utility to verify .MDB data files? Best Regards, Nagesh

4 3

newer TLS clients (> 3.0?) can't connect to OpenLDAP's TLS with SSSD
by Jarett DeAngelis 11 Jan '23

11 Jan '23

hi - using OpenLDAP 2.6.3 and finding that newer LDAP client libraries (like the one that comes with Ubuntu 22.04.1 LTS) can't complete a connection to the LDAP server's TLS port. A machine I have running Rocky 8.6, however, with OpenSSL 1.1.1k, connects just fine. This is using self-generated certificates, but the correct CA cert and server cert have been provided to SSSD to use for login. The two machines are using identical certificates and SSSD configuration files. How do we begin to troubleshoot this? The trouble is seen in the SSSD log: (2023-01-09 21:08:26): [be[default]] [fo_resolve_service_send] (0x0100): [RID#13] Trying to resolve service 'LDAP' (2023-01-09 21:08:26): [be[default]] [get_server_status] (0x1000): [RID#13] Status of server '10.8.8.60' is 'name not resolved' (2023-01-09 21:08:26): [be[default]] [get_port_status] (0x1000): [RID#13] Port status of port 636 for server '10.8.8.60' is 'neutral' (2023-01-09 21:08:26): [be[default]] [fo_resolve_service_activate_timeout] (0x2000): [RID#13] Resolve timeout [dns_resolver_timeout] set to 6 seconds (2023-01-09 21:08:26): [be[default]] [get_server_status] (0x1000): [RID#13] Status of server '10.8.8.60' is 'name not resolved' (2023-01-09 21:08:26): [be[default]] [set_server_common_status] (0x0100): [RID#13] Marking server '10.8.8.60' as 'resolving name' (2023-01-09 21:08:26): [be[default]] [check_if_online_delayed] (0x2000): [RID#12] Check online req created. (2023-01-09 21:08:26): [be[default]] [set_server_common_status] (0x0100): [RID#13] Marking server '10.8.8.60' as 'name resolved' (2023-01-09 21:08:26): [be[default]] [be_resolve_server_process] (0x1000): [RID#13] Saving the first resolved server (2023-01-09 21:08:26): [be[default]] [be_resolve_server_process] (0x0200): [RID#13] Found address for server 10.8.8.60: [10.8.8.60] TTL 7200 (2023-01-09 21:08:26): [be[default]] [sdap_uri_callback] (0x0400): [RID#13] Constructed uri 'ldaps://10.8.8.60:636' (2023-01-09 21:08:26): [be[default]] [sssd_async_socket_init_send] (0x4000): [RID#13] Using file descriptor [23] for the connection. (2023-01-09 21:08:26): [be[default]] [sssd_async_socket_init_send] (0x0400): [RID#13] Setting 60 seconds timeout [ldap_network_timeout] for connecting (2023-01-09 21:08:26): [be[default]] [sss_ldap_init_sys_connect_done] (0x0020): [RID#13] ldap_install_tls failed: [Connect error] [unknown error] (2023-01-09 21:08:26): [be[default]] [sss_ldap_init_state_destructor] (0x0400): [RID#13] calling ldap_unbind_ext for ldap:[0x55c44d26c1b0] sd:[23] (2023-01-09 21:08:26): [be[default]] [sss_ldap_init_state_destructor] (0x0400): [RID#13] closing socket [23] (2023-01-09 21:08:26): [be[default]] [sdap_sys_connect_done] (0x0020): [RID#13] sdap_async_connect_call request failed: [5]: Input/output error. (2023-01-09 21:08:26): [be[default]] [sdap_handle_release] (0x2000): [RID#13] Trace: sh[0x55c44d24a740], connected[0], ops[(nil)], ldap[(nil)], destructor_lock[0], release_memory[0] (2023-01-09 21:08:26): [be[default]] [_be_fo_set_port_status] (0x8000): [RID#13] Setting status: PORT_NOT_WORKING. Called from: ../src/providers/ldap/sdap_async_connection.c: sdap_cli_connect_done: 1633 (2023-01-09 21:08:26): [be[default]] [fo_set_port_status] (0x0100): [RID#13] Marking port 636 of server '10.8.8.60' as 'not working' (2023-01-09 21:08:26): [be[default]] [fo_set_port_status] (0x0400): [RID#13] Marking port 636 of duplicate server '10.8.8.60' as 'not working' Thanks, Jarett

5 4

Help for filter in openldap server
by baalchina 09 Jan '23

09 Jan '23

Hi, all I had a old openldap server from my colleague, and I am studying the server. I found a strange problem, when I using client(ldapadmin in Windows), I can filter by uid, objectClass,sn or anything else, but except inetUserStatus. For example, when I searching by 'sn=*', or 'sn=Jim', which jim is the exact name of my user, I will got the correct result. But when I searching by 'inetUserStatus=Inactive' or 'inetUserStatus=Active', nothing happens. I also tried 'inetUserStatus=*', and got the whole ldap users. The same happens in the memberOf attribute, which 'memberOf=*' got the whole users, and 'memberOf=cn=ABC*' got nothing. (My ldap users all have a attribute of 'memberOf: cn=ABC,ou=Groups,dc=abc,dc=cn'. So, what should I do if I want to using this two attribute memberOf and inetUserStatus? Thanks a lot. -- from:baalchina

2 1

Slow Mod operations on LDAP
by Bhanush Mehta 09 Jan '23

09 Jan '23

Hi All, We are seeing very slow MOD operations on our ldap (250 MB data dump), while using mdb (data.mdb is 6.4 Gb). The average MOD operation is going to 8-9 seconds. We are seeing 1k disk ops and 6-7MB/s writes. The disk is 4096 IOPS Sata SSD, we have seen write speed to be 126 MB/s generally. The slapd version is slapd (May 14 2022 18:35:44). We the following olcDbIndex for eq: objectClass, entryCSN , entryUUID eq, uid , uidNumber , uniqueMember ,gidNumber , memberUid ,displayName ,cn ,sn , member, source , supervisor ,accountExpiryDate And, sortVals for memberUid and member. Regards Bhanush -- *-----------------------------------------------------------------------------------------* *This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee, you should not disseminate, distribute or copy this email. Please notify the sender immediately by email if you have received this email by mistake and delete this email from your system. If you are not the intended recipient, you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.***** **** *Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the organization. Any information on shares, debentures or similar instruments, recommended product pricing, valuations and the like are for information purposes only. It is not meant to be an instruction or recommendation, as the case may be, to buy or to sell securities, products, services nor an offer to buy or sell securities, products or services unless specifically stated to be so on behalf of the Flipkart group. Employees of the Flipkart group of companies are expressly required not to make defamatory statements and not to infringe or authorise any infringement of copyright or any other legal right by email communications. Any such communication is contrary to organizational policy and outside the scope of the employment of the individual concerned. The organization will not accept any liability in respect of such communication, and the employee responsible will be personally liable for any damages or other liability arising.***** **** *Our organization accepts no liability for the content of this email, or for the consequences of any actions taken on the basis of the information *provided,* unless that information is subsequently confirmed in writing. If you are not the intended recipient, you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.* _-----------------------------------------------------------------------------------------_

2 2

OpenLDAP stats logging performance degradation
by Christopher Paul 04 Jan '23

04 Jan '23

Hello OpenLDAP-Technical, Using the oldie but goodie LDAP performance testing tool, SLAMD, I've been doing performance tests. What I found was that stats logging (olcLogLevel: 256) degrades performance significantly. A pity, because it is recommended in the manual. Also, it considered very useful by those of us who've been running OpenLDAP for a while. The test was performed on Dell Workstation Intel Xeon E-2630 v3 @ 2.40Ghz Xen 4.6.5 hypervisor running Linux 4.4.0 Ubuntu 16.04, 4 vcpus pinned to the hypervisor and the other 12 pinned to the OpenLDAP VM. The OpenLDAP VM was allocated 8GB RAM and runs OpenLDAP 2.5.13 (Symas RPM build) on RedHat 8.7. Ten thousand fake users were created in an OU=FakePeople for testing. I am aware that contention with disk I/O can cause problems, so I tried eliminating systemd-journald and rsyslogd in order to test "pure OpenLDAP" response times but was not perfectly successful. I ran slapd in the foreground using "slapd -d 256 ... 2>/dev/null". But then I noticed that systemd-journald still was logging to "session-4.scope". I tried "systemctl stop systemd-journald" and "systemctl stop systemd-journald.socket" and "systemctl stop systemd-journald-dev-log.socket" but was not able to stop systemd-journald from showing up using CPU in "htop". I tried limiting it also by setting RateLimitIntervalSec=1s and RateLimitBurst=1 in /etc/system/journald.conf. This reduced the logging but I still saw "/usr/lib/system/systemd-journald" taking 100% of one vcpu during the performance tests whenever olcLogLevel was set to 256. The test results I will include with this post are from the Asynchronous Search Rate SLAMD job class using LDAPSearch filters of valid random values for indexed attributeTypes "uid" and "mail" matching exact filters (equality match). Using LogLevel 256, the Asynchronous Search Rate test with 3 clients, 2 connection threads each (from laptop i7-1280P vPro Processor), OpenLDAP returned an average 10,932 results completed per second with err=0 and average 21ms response time. Then I ran ldapmodify to changetype: replace olcLogLevel to 0, reran the same test, and saw OpenLDAP perform much better. The same test with olcLogLevel=0 returned 84,286 results per second with err=0 (671% increase) and average response time of 2.6 ms (88% decrease). Watching "htop" during this test showed all vcpus firing a lot more evenly and hotter than the test with olcLogLevel=256; it was very clear how efficient slapd can be without having to do any logging. I ran several samples of each test and picked the best for each of olcLogLevels I tested. I ran other tests like 3 and 4 clients times 50 connections each, also ran Basic Bind Rate and saw similar patterns there. I don't mind sharing my configs or the test data if anyone is interested. And so naturally, I am wondering if this is a known limitation and also whether it is something that can be addressed or is a hard constraint. I guess I had expected some impact as a result of logging (nothing comes for free...) but not this much. Thanks, Chris Paul | Rex Consulting | https://www.rexconsulting.net

4 5

slappasswd generating a supposedly incorrect password hash (only when using {SHA256})
by Ralf Hildebrandt 29 Dec '22

29 Dec '22

Using slapd 2.5.13+dfsg-1ubuntu1 on ubuntu 22.10: ================================================= The password hashes are differing between what "slappasswd" and "openssl dgst" emit: $ slappasswd -s secret -h '{SHA256}' -o module-path=/usr/lib/ldap -o module-load=pw-sha2 {SHA256}WIrrpN3OjEVOUf6yrH1j+o+ODuUuNBo979Od4UXnu54= $ echo -n "secret" | openssl dgst -sha256 -binary | openssl enc -base64 K7gNU3sdo+OL0wNhqoVWhr3g6s1xYv72ol/pe/Unols= With SHA512 on the other hand, the hash generated by different programs is identical: $ slappasswd -s secret -h '{SHA512}' -o module-path=/usr/lib/ldap -o module-load=pw-sha2 {SHA512}vSsar3708Jvp9Szi2NWZZ02Bqp1qRCFpbcTZPdBhnWgs5WtNZKnvCXdhztmeD2cmW192CF5bDufKRpayrW/isg== $ echo -n "secret" | openssl dgst -sha512 -binary | openssl enc -base64 vSsar3708Jvp9Szi2NWZZ02Bqp1qRCFpbcTZPdBhnWgs5WtNZKnvCXdhztmeD2cm W192CF5bDufKRpayrW/isg== On an older box (ubuntu 20.04) with slapd 2.4.49+dfsg-2ubuntu1.9 we're seeing: ============================================================================== $ slappasswd -s secret -h '{SHA256}' -o module-path=/usr/lib/ldap -o module-load=pw-sha2 {SHA256}K7gNU3sdo+OL0wNhqoVWhr3g6s1xYv72ol/pe/Unols= $ echo -n "secret" | openssl dgst -sha256 -binary | openssl enc -base64 K7gNU3sdo+OL0wNhqoVWhr3g6s1xYv72ol/pe/Unols= So why is the SHA256 password hash generated by the 2.5.13 slappasswd command different from the hashes generated by the other programs/versions? -- Ralf Hildebrandt Charité - Universitätsmedizin Berlin Geschäftsbereich IT | Abteilung Netzwerk Campus Benjamin Franklin (CBF) Haus I | 1. OG | Raum 105 Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 ralf.hildebrandt(a)charite.de https://www.charite.de

3 3

Question about Persistent Search
by pham lan 19 Dec '22

19 Dec '22

Hello, I am new to OpenLDAP. May I ask if Persistent Search is supported in any version of OpenLdap Server? I installed version 2.4.46 from Rocky repo and it does not seem to support persistent search.

5 8

lloadd Proxied Authorization Denied (123)
by Stefan Kania 16 Dec '22

16 Dec '22

I now took the example configuration and changed it to my settings: --------------------- TLSCertificateFile /opt/symas/etc/openldap/example-net-cert.pem TLSCertificateKeyFile /opt/symas/etc/openldap/example-net-key.pem TLSCACertificateFile /opt/symas/etc/openldap/cacert.pem pidfile /var/symas/run/slapd.pid argsfile /var/symas/run/slapd.args loglevel 256 modulepath /opt/symas/lib/openldap moduleload lloadd.la backend lload listen "ldap://:1389 ldaps://:1636" feature proxyauthz TLSShareSlapdCTX true bindconf bindmethod=simple network-timeout=5 tls_cacert="/opt/symas/etc/openldap/cacert.pem" tls_cert="/opt/symas/etc/openldap/example-net-cert.pem" tls_key="/opt/symas//etc/openldap/example-net-key.pem" binddn=uid=lloadd,ou=users,dc=example,dc=net credentials=geheim tier roundrobin backend-server uri=ldaps://ldap01.example.net starttls=critical retry=5000 max-pending-ops=50 conn-max-pending=10 numconns=10 bindconns=5 backend-server uri=ldaps://ldap02.example.net starttls=critical retry=5000 max-pending-ops=50 conn-max-pending=10 numconns=10 bindconns=5 database monitor --------------------- The bind-user exists in the database of the backend-server. If i start the loadbalancer I can see that the connection are established. -------ldap01----------- Dez 14 21:07:12 ldap01 slapd[550]: conn=1380 fd=46 ACCEPT from IP=192.168.56.40:38674 (IP=0.0.0.0:636) Dez 14 21:07:12 ldap01 slapd[550]: conn=1380 fd=46 TLS established tls_ssf=256 ssf=256 tls_proto=TLSv1.3 tls_cipher=TLS_AES_256_GCM_SHA384 Dez 14 21:07:12 ldap01 slapd[550]: conn=1380 op=0 BIND dn="uid=lloadd,ou=users,dc=example,dc=net" method=128 Dez 14 21:07:12 ldap01 slapd[550]: conn=1380 op=0 BIND dn="uid=lloadd,ou=users,dc=example,dc=net" mech=SIMPLE bind_ssf=0 ssf=256 ------------------------ I see the same massages on ldap02, so that's ok The I do a search from a different machine: ------------- root@ldap03:~# ldapsearch -x -D uid=repl-user,ou=users,dc=example,dc=net -w geheim -H ldaps://loadbalancer.example.net:1636 -LLL Proxied Authorization Denied (123) Additional information: not authorized to assume identity ------------ The uid=repl-user has read permission to all objects and attributes. On ldap01 I see: ---------ldap01------------- Dez 14 21:09:13 ldap01 slapd[550]: conn=1371 op=0 BIND dn="uid=repl-user,ou=users,dc=example,dc=net" method=128 Dez 14 21:09:13 ldap01 slapd[550]: conn=1371 op=0 BIND dn="uid=repl-user,ou=users,dc=example,dc=net" mech=SIMPLE bind_ssf=0 ssf=256 Dez 14 21:09:13 ldap01 slapd[550]: conn=1371 op=0 RESULT tag=97 err=0 qtime=0.000033 etime=0.015255 text= ----------------------------- on ldap02 --------ldap02---------- Dez 14 21:09:13 ldap02 slapd[300]: conn=1306 op=1 SEARCH RESULT tag=101 err=123 qtime=0.000044 etime=0.000235 nentries=0 text=not authorized to assume identity Dez 14 21:09:13 ldap02 slapd[300]: conn=1306 op=1 do_search: get_ctrls failed ------------------------ Why do I get different log-entries on the backend-server? And what did I forgot? When I do a ldapsearch with uid=lloadd I get: ------------------- root@ldap03:~# ldapsearch -x -D uid=lloadd,ou=users,dc=example,dc=net -w geheim -H ldaps://loadbalancer.example.net:1636 -LLL dn: dc=example,dc=net objectClass: domain objectClass: dcObject dc: example ------------------- That's the only object the user has permissions to read. log from ldap01 -------------------- Dez 14 21:14:04 ldap01 slapd[550]: conn=1381 op=0 BIND dn="uid=lloadd,ou=users,dc=example,dc=net" method=128 Dez 14 21:14:04 ldap01 slapd[550]: conn=1381 op=0 BIND dn="uid=lloadd,ou=users,dc=example,dc=net" mech=SIMPLE bind_ssf=0 ssf=256 Dez 14 21:14:04 ldap01 slapd[550]: conn=1381 op=0 RESULT tag=97 err=0 qtime=0.000021 etime=0.008984 text= -------------------- and log from ldap02 -------------------- Dez 14 21:14:04 ldap02 slapd[300]: conn=1308 op=1 SRCH base="dc=example,dc=net" scope=2 deref=0 filter="(objectClass=*)" Dez 14 21:14:04 ldap02 slapd[300]: conn=1308 op=1 SEARCH RESULT tag=101 err=0 qtime=0.000022 etime=0.002048 nentries=1 text= -------------------- That's also ok, I think . The final version should be that the binduser uid=lloadd will not see anything. So what's the point I'm missing to get proxyauthz work correctly?

4 9

lloadd standalone daemon
by Stefan Kania 15 Dec '22

15 Dec '22

Hi to all, I want to test the "lloadd" as a standalone daemon. I'm using the symas OpenLDAP 2.6 packages on a debian 11 system. I can only find the module "lloadd.la" but not the standalone daemon. If I want to us it, do I have to compile it myself? What would be the better way using the standalone daemon or use it as a module as part of slapd. Stefan

3 5

openldap TLSv1.0 is enabled
by Andre Rodier 15 Dec '22

15 Dec '22

Hello, I have configured OpenLDAP using SSL certificate, but I have a few issues. Here the TLS configuration, especially "olcTLSProtocolMin: 3.3" > # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. > # CRC32 c70363a6 > dn: cn=config > objectClass: olcGlobal > cn: config > olcArgsFile: /var/run/slapd/slapd.args > olcLogLevel: none > olcPidFile: /var/run/slapd/slapd.pid > olcToolThreads: 1 > structuralObjectClass: olcGlobal > entryUUID: 40ee991a-0efe-103d-855a-11ff3a5638b4 > creatorsName: cn=config > createTimestamp: 20221213065102Z > olcPasswordCryptSaltFormat: $6$%.16s > olcTLSCACertificateFile: /etc/ldap/certs/ldap.homebox.world.issuer.crt > olcTLSCertificateKeyFile: /etc/ldap/certs/ldap.homebox.world.key > olcTLSCertificateFile: /etc/ldap/certs/ldap.homebox.world.crt > olcTLSProtocolMin: 3.3 > entryCSN: 20221214054517.926245Z#000000#000#000000 > modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth > modifyTimestamp: 20221214054517Z But if I try sslscan: I see TLSv1.0, TLSv1.1 and TLSv1.2 enabled. Why ? > root@main:/etc/ldap/changes# sslscan ldap.homebox.world:636 > Version: 2.0.7 > OpenSSL 1.1.1n 15 Mar 2022 > > Connected to 2001:19f0:7402:86e:5400:4ff:fe38:b9b4 > > Testing SSL server ldap.homebox.world on port 636 using SNI name ldap.homebox.world > > SSL/TLS Protocols: > SSLv2 disabled > SSLv3 disabled > TLSv1.0 enabled > TLSv1.1 enabled > TLSv1.2 enabled > TLSv1.3 enabled > > TLS Fallback SCSV: > Server supports TLS Fallback SCSV > > TLS renegotiation: > Secure session renegotiation supported > > TLS Compression: > OpenSSL version does not support compression > Rebuild with zlib1g-dev package for zlib support > > Heartbleed: > TLSv1.3 not vulnerable to heartbleed > TLSv1.2 not vulnerable to heartbleed > TLSv1.1 not vulnerable to heartbleed > TLSv1.0 not vulnerable to heartbleed > > Supported Server Cipher(s): > Preferred TLSv1.3 128 bits TLS_AES_128_GCM_SHA256 Curve 25519 DHE 253 > Accepted TLSv1.3 256 bits TLS_AES_256_GCM_SHA384 Curve 25519 DHE 253 > Accepted TLSv1.3 256 bits TLS_CHACHA20_POLY1305_SHA256 Curve 25519 DHE 253 > Accepted TLSv1.3 128 bits TLS_AES_128_CCM_SHA256 Curve 25519 DHE 253 > Preferred TLSv1.2 256 bits ECDHE-RSA-AES256-GCM-SHA384 Curve 25519 DHE 253 > Accepted TLSv1.2 256 bits ECDHE-RSA-CHACHA20-POLY1305 Curve 25519 DHE 253 > Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-GCM-SHA256 Curve 25519 DHE 253 > Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-SHA Curve 25519 DHE 253 > Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA Curve 25519 DHE 253 > Accepted TLSv1.2 256 bits AES256-GCM-SHA384 > Accepted TLSv1.2 256 bits AES256-CCM > Accepted TLSv1.2 128 bits AES128-GCM-SHA256 > Accepted TLSv1.2 128 bits AES128-CCM > Accepted TLSv1.2 256 bits AES256-SHA > Accepted TLSv1.2 128 bits AES128-SHA > Preferred TLSv1.1 256 bits ECDHE-RSA-AES256-SHA Curve 25519 DHE 253 > Accepted TLSv1.1 128 bits ECDHE-RSA-AES128-SHA Curve 25519 DHE 253 > Accepted TLSv1.1 256 bits AES256-SHA > Accepted TLSv1.1 128 bits AES128-SHA > Preferred TLSv1.0 256 bits ECDHE-RSA-AES256-SHA Curve 25519 DHE 253 > Accepted TLSv1.0 128 bits ECDHE-RSA-AES128-SHA Curve 25519 DHE 253 > Accepted TLSv1.0 256 bits AES256-SHA > Accepted TLSv1.0 128 bits AES128-SHA > > Server Key Exchange Group(s): > TLSv1.3 128 bits secp256r1 (NIST P-256) > TLSv1.3 192 bits secp384r1 (NIST P-384) > TLSv1.3 260 bits secp521r1 (NIST P-521) > TLSv1.3 128 bits x25519 > TLSv1.3 224 bits x448 > TLSv1.3 112 bits ffdhe2048 > TLSv1.3 128 bits ffdhe3072 > TLSv1.3 150 bits ffdhe4096 > TLSv1.3 175 bits ffdhe6144 > TLSv1.3 192 bits ffdhe8192 > TLSv1.2 128 bits secp256r1 (NIST P-256) > TLSv1.2 192 bits secp384r1 (NIST P-384) > TLSv1.2 260 bits secp521r1 (NIST P-521) > TLSv1.2 128 bits x25519 > TLSv1.2 224 bits x448 > > SSL Certificate: > Signature Algorithm: sha256WithRSAEncryption > RSA Key Strength: 2048 > > Subject: ldap.homebox.world > Altnames: DNS:ldap.homebox.world > Issuer: (STAGING) Artificial Apricot R3 > > Not valid before: Dec 13 05:34:29 2022 GMT > Not valid after: Mar 13 05:34:28 2023 GMT Thanks for your insights. Andre

5 11

Service Accounts in Consumer databases
by thomaswilliampritchard＠gmail.com 14 Dec '22

14 Dec '22

Hello, I am building a health check for a consumer that replicates a subset of data from a provider's application database. I do not want to incorporate a service account into the replicated data set because it is not my organization to be adding service users to. I also do not want to use the consumer root credentials for health checking but would prefer to add a service account with limited ACL access to the consumers I can use to issue test binds and ensure SLAPD is running properly. Do you have suggestions on how I can add a service account to a consumer? Currently we are getting "ldap_add: Server is unwilling to perform (53) additional info: shadow context; no update referral" which I believe is because consumers are simply read only. Thanks for the consideration Thomas

1 0

Overlays accesslog and dynlist
by Carsten Jäckel 13 Dec '22

13 Dec '22

Hello experts, we are using OpenLDAP 2.5.13 and we are facing problems using the accesslog overlay along with the dynlist overlay. As long as we use only the accesslog overlay the logging works as expected. Successfully logged search access: ldapsearch -H ldaps://ldap.example.com:636 -D cn=manager,dc=example,dc=com -W -b dc=users,dc=example,dc=com cn=user1 mail Result of ldapsearch -H ldaps://ldap.example.com:636 -D cn=log -W -b cn=log objectclass=*: ###################################### ... # 20221212145029.000000Z, log dn: reqStart=20221212145029.000000Z,cn=log objectClass: auditBind reqStart: 20221212145029.000000Z reqEnd: 20221212145029.000001Z reqType: bind reqSession: 1022 reqAuthzID: reqDN: cn=manager,dc=example,dc=com reqResult: 0 reqVersion: 3 reqMethod: SIMPLE # 20221212145029.000002Z, log dn: reqStart=20221212145029.000002Z,cn=log objectClass: auditSearch reqStart: 20221212145029.000002Z reqEnd: 20221212145029.000003Z reqType: search reqSession: 1022 reqAuthzID: manager,dc=example,dc=com reqDN: dc=users,dc=example,dc=com reqResult: 0 reqScope: sub reqDerefAliases: never reqAttrsOnly: FALSE reqFilter: (cn=user1) reqAttr: mail reqEntries: 1 reqTimeLimit: -1 reqSizeLimit: -1 # 20221212145029.000004Z, log dn: reqStart=20221212145029.000004Z,cn=log objectClass: auditObject reqStart: 20221212145029.000004Z reqEnd: 20221212145029.000005Z reqType: unbind reqSession: 1022 reqAuthzID: manager,dc=example,dc=com ###################################### After adding overlay dynlist the information in the accesslog database after the same search operation ldapsearch -H ldaps://ldap.example.com:636 -D cn=manager,dc=example,dc=com -W -b dc=users,dc=example,dc=com cn=user1 mail is as follows: ###################################### ... # 20221212144859.000000Z, log dn: reqStart=20221212144859.000000Z,cn=log objectClass: auditBind reqStart: 20221212144859.000000Z reqEnd: 20221212144859.000001Z reqType: bind reqSession: 1019 reqAuthzID: reqDN: manager,dc=example,dc=com reqResult: 0 reqVersion: 3 reqMethod: SIMPLE # 20221212144859.000002Z, log dn: reqStart=20221212144859.000002Z,cn=log objectClass: auditSearch reqStart: 20221212144859.000002Z reqEnd: 20221212144859.000003Z reqType: search reqSession: 1019 reqAuthzID: manager,dc=example,dc=com reqDN: dc=users,dc=example,dc=com reqResult: 0 reqScope: sub reqDerefAliases: never reqAttrsOnly: FALSE reqFilter: (objectClass=groupOfURLs) reqAttr: memberURL reqEntries: 0 reqTimeLimit: -1 reqSizeLimit: -1 # 20221212144859.000005Z, log dn: reqStart=20221212144859.000005Z,cn=log objectClass: auditObject reqStart: 20221212144859.000005Z reqEnd: 20221212144859.000006Z reqType: unbind reqSession: 1019 reqAuthzID: manager,dc=example,dc=com ###################################### Is it possible that the configuration of the dynlist overlay somehow overrides the configuration of the accesslog overlay? Changing the order of the overlays has no impact. Are there some dependencies between the accesslog and the dynlist overlay that we didn't attend to in the slapo-accesslog/slapo-dynlist manuals? Is there something wrong in our configuration? Configuration: ###################################### dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb ... olcSuffix: dc=example,dc=com olcSyncUseSubentry: FALSE dn: olcOverlay={0}refint,olcDatabase={1}mdb,cn=config objectClass: olcConfig objectClass: olcOverlayConfig objectClass: olcRefintConfig objectClass: top olcOverlay: {0}refint olcRefintAttribute: member olcRefintAttribute: memberOf olcRefintNothing: cn=tgroup,dc=groups,dc=example,dc=com dn: olcOverlay={1}ppolicy,olcDatabase={1}mdb,cn=config objectClass: olcConfig objectClass: olcOverlayConfig objectClass: olcPPolicyConfig objectClass: top olcOverlay: {1}ppolicy olcPPolicyHashCleartext: TRUE dn: olcOverlay={2}dynlist,olcDatabase={1}mdb,cn=config objectClass: olcConfig objectClass: olcDynListConfig objectClass: olcOverlayConfig objectClass: top olcOverlay: {2}dynlist olcDynListAttrSet: {0}groupOfURLs memberURL member+memberOf@groupOfNames dn: olcOverlay={3}lastbind,olcDatabase={1}mdb,cn=config objectClass: olcConfig objectClass: olcLastBindConfig objectClass: olcOverlayConfig objectClass: top olcOverlay: {3}lastbind olcLastBindPrecision: 86400 dn: olcOverlay={4}accesslog,olcDatabase={1}mdb,cn=config objectClass: olcAccessLogConfig objectClass: olcConfig objectClass: olcOverlayConfig objectClass: top olcAccessLogDB: cn=log olcOverlay: {4}accesslog olcAccessLogOld: (objectClass=inetOrgPerson) olcAccessLogOldAttr: description olcAccessLogOps: all olcAccessLogPurge: 01:00 00:15 ###################################### Any help is apreciated, thank you very much in advance. Carsten

3 2

Detecting replication delay when replicating a subset of data
by thomaswilliampritchard＠gmail.com 13 Dec '22

13 Dec '22

Hello, Under typical circumstances we run a config database and have a single application database for ldap data. We run consumers replicating from providers where they replicate the entire application database. We detect delayed replication by querying consumer CSNs and comparing them to the provider CSNs to determine if any consumers have delayed replication through a health check script that executes every few minutes. For one particular use case we replicate a subset of the application database, but our replication check cannot work for this use case. It appears because we're not replicating the entire database we do not copy the provider CSNs over to the consumers (which live at the base level, and we're copying a DIT below that level) and therefore I cannot ask the consumers what their 'latest csn' is since they do not seem to have one. Is there any recommended way I can check that the consumer replication is functioning properly when replicating a subset of the provider database? Thanks for the consideration. Tom

5 4

question about access control
by Alex Samad - Yieldbroker 10 Dec '22

10 Dec '22

Hi From the online doco re > Level Privileges Description > none = 0 no access > disclose = d needed for information disclosure on error > auth = dx needed to authenticate (bind) > compare = cdx needed to compare > search = scdx needed to apply search filters > read = rscdx needed to read search results > write = wrscdx needed to modify/rename > manage = mwrscdx needed to manage I couldn't find out what the difference between manage and write is what does the M allow for. olcAccess: to dn.subtree="ou=Users," by dn.exact="cn=directory,ou=Roles," manage by * break so for the subtree ou=User I want to allow cn=directory to add / modify / delete any children of ou=Users. Reading the doco its seems like I only need to give it write access, what can I do extra with manage ? Also for userPassword attr to write to it do I need to have the read or can I just have =wd Thanks Alex

2 1

LDAP VLV throws error "Other sort requests already in progress"
by rathore_pushpendra21＠yahoo.co.in 08 Dec '22

08 Dec '22

The bounty expires in 7 days. Answers to this question are eligible for a +200 reputation bounty. NG. wants to draw more attention to this question. I am trying to implement pagination in LDAP using vlv, using reference from document https://docs.ldap.com/ldap-sdk/docs/javadoc/com/unboundid/ldap/sdk/controls… it is working fine with single thread, but when try with multiple threads concurrently upto 5 threads it works fine, but as number of threads increased only 5 threads can run successfully exceed threads got failed with below error message: LDAPException(resultCode=51 (busy), numEntries=0, numReferences=0, diagnostiMessage='Other sort requests already in progress', ldapSDKVersion=5.1.1.. I am using OpenLDAP, Unboundid api for connection with Java. About data size it is around 100k. Tried with single connection and multiple connections(with multiple concurrent threads) getting same error in both cases. Tried to synchronize block for fetching data. On exception, make thread to wait and try again. All above things didn't worked, threads cannot fetch data from LDAP. After trying to close and reconnect connection as described in https://www.openldap.org/lists/openldap-technical/201107/msg00006.html failed thread can fetch data but after retry lot of times, in my case thread retried about 2k times then it started fetching data. Is there any better solution, retrying 2k times and getting result is not a good option.

2 2

Q: Length of {SSHA} encoded passwords
by Ulrich Windl 05 Dec '22

05 Dec '22

Hi! Examining changes of the database via LDIF, I noticed one thing: -userPassword: {SSHA}XY94+nfFELR3iy0AYTsS0DHqxIOwFNz79zcnniA== +userPassword: {SSHA}yt98Od1WHak3kYIyZWYoCewg4D+f9ffp I had thought that the encoded SSHA passwords all have the same length. Could it depend on the program being used to vhnage the password, thus varying the length of salt? How could I decode that? (not that the example is not a real one (some characters permutated), so don't waste your time trying to crack it) Regards, Ulrich

3 2

Syncrepl has stopped 24 hours ago
by Bradley T Gill 01 Dec '22

01 Dec '22

Our accesslog mdb is 2GB and syncrepl has been 'late' (according to Nagios) on all of our servers for 24 hours now. We are in the middle of Significant Incident and am asking for suggestions of what to look for in the logs? All of the syncprov_ activities in the log seem fine. I have done a rolling restart of our servers to see if that could spark them to sync, with no positive results. Thanks, [cid:image001.png@01D903D9.98037410]<http://www.aep.com/> BRADLEY T GILL | INFRASTRUCTURE ENGINEER STAFF BGILL(a)AEP.COM<mailto:BGILL@AEP.COM> | A:8.200.3054 1 RIVERSIDE PLAZA, COLUMBUS, OH 43215

2 5

dynlist dynamic attributes (memberof) work and doesnt work in filter querys from some apps
by andreas.ladanyi＠kit.edu 01 Dec '22

01 Dec '22

Using slapd 2.5 with dynlist to generate memberof. We use sssd ldap provider with ldap_user_search_filter parameter and memberof filter and only the user which are memberof=XY are in the sssd cache. So it works as expected, since slapd 2.5 We use ldapsearch with memberof filter and it works as expected, since slapd 2.5 Iam trying out some webapps, configure the ldap filter and iam wondering because the filter with the memberof attribute will be transmitted to slapd but there is no search result in the slapd.log. If i copy the webapp ldap filter from the slapd log and try it out with ldapsearch on the webapp server i get search results. Could somebody clearify me ?

3 4

Checking users password
by Ian Porter 25 Nov '22

25 Nov '22

Hi I have tried to change a users password either by ldappasswd -H ldapi:/// -x -D "ADMIN ACCOUNT" -W -S "uid=USER,ou=USER,o=ORG" or via a ldif file with ldapmodify ldapmodify -H ldap:// -x -D "ADMIN ACCOUNT" -W -f ./password.ldif dn: uid=USER,ou=USER,o=ORG changetype: modify replace: userPassword userPassword: {SSHA}SSHAPASSWORD HERE where the ADMIN ACCOUNT / USER etc have been replaced with the ldap cn=manager etc, but every time I try to confirm that the password has been updated via ldapwhoami -x -W -D "uid=USER,ou=USER,o=ORG" -H ldapi:/// Enter LDAP Password: ldap_bind: Invalid credentials (49) I keep on getting the ldap_bind invalid credentials, I have tested the userPassword attribute via the apache directory studio and verified the userPassword is correct. Any advice, please Ian <https://www.intergence.com>[cid:banner2_39fe1610-59f4-4ba9-b81b-b4e5f6191cb2.png]<https://www.intergence.com> Intergence Systems Ltd. The Old Coach House, Brewery Road, Pampisford, Cambridge, CB22 3HG Tel: +44 845 226 4167 www.intergence.com<http://www.intergence.com> <https://www.linkedin.com/company/intergence-ltd/>[cid:linkedin_68c71b8e-8abf-4fd8-b701-d259821decc2.png]<https://www.linkedin.com/company/intergence-ltd/> <https://www.youtube.com/channel/UCwaP6ynaEpd6dFmPvWAwblA> <https://www.youtube.com/channel/UCwaP6ynaEpd6dFmPvWAwblA> [cid:twitter_60a1d18f-2ce6-4f9a-bea8-77d45272960f.png] <https://twitter.com/intergence> Intergence Systems Limited Disclaimer: This email may contain Copyright Material and/or sensitive or protectively marked / classified material. The email is intended for the named addressee(s). Unless you are the named addressee (or authorised to receive it for the addressee), you may not copy, use it, or disclose it to anyone else. If you have received this transmission in error please notify the sender immediately. All email traffic may be subject to recording and/or monitoring in accordance with relevant legislation. Correspondence sent to Intergence Systems Limited is treated as being sent to the organisation as a whole and may be shared within the organisation and/or legitimate and authorised external organisations to enable the matter contained therein to be dealt with appropriately and/or to comply with legislative requirements. Intergence Systems Limited does not accept service of documents by e-mail.

2 2

Push replication issue for the pwdHistory attribute
by Daniel Hoffend 19 Nov '22

19 Nov '22

Hello, I'm using a master ldap instance with a push replication instance to external slaves using the ldap backend on Debian 11 (2.4.57) and I came across some replication issues that forces me to drop the slave dbs and do a manually fullsync everything this error occurs. The problem =========== I know that replication and maintaining a password policy is a complicated task, especially since the ppolicy overlay must be loaded and active in every instance (master, push instance, slave). This problem leads to interesting challanges. First, I encountered a problem where pwdChangedTime would be duplicate because the ppolicy overlay of the push instance and the back_ldap/slave instance would like to set it (which leads to a duplicate attribute error). To fix problem I backported the patch [1] to my local version of the slapd packages. After this problem was fixed, I've encountered the next problematic attribute: "pwdHistory". I've play around with some syncrepl settings, but in the end, it seems to be a similar issue. It looks likes the pwdHistory attribute is not yet present on the slave and both instances (push and slave) try to add the pwdHistory Attributes which leads to a problem where both entries collied (pwdHistory: value #0 already exists). For whatever reason pwdHistory doesn't show up as modified field on the slave in the MOD request. But anyways. Something seems to be wrong, and it could a similar replication issue compared with pwdChangedTime I've lookup into the change history of the ppolicy.c file in the 2.5 and 2.6 branch but couldn't find a newer commit that would address this issue. Does anyone has encountered a similar issue? I've not played around with the 2.5 or 2.6 version, but looking at the code, I've either not seen a fix or the problem might still exist, hopefully I am wrong. Any suggestions? -- best regards Daniel Hoffend [1] https://github.com/openldap/openldap/commit/7a34f46d1cabe8e80937d5167b62152… Setup ===== Host Master - Debian 11 slapd 2.4.57+dfsg-3 - slapd master instance with cn=config - push replikation instance with simple config (syncrepl from localhost, write to backend ldap) Host Slave - Debian 11 slapd 2.4.57+dfsg-3 - Readonly slave On all 3 instances ppolicy is enabled otherwise the operational attributes would be not known/available and sync of locked accounts or per account selected password policy assignment wouldn't work. PUSH Replication Instance ========================= database ldap [...] overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=example,dc=org" syncrepl rid=__RID__ provider=ldap://localhost:389/ binddn="cn=replication,ou=system,dc=example,dc=org" bindmethod=simple credentials="secret" searchbase="dc=example,dc=org" type=refreshAndPersist schemachecking=off retry="5 12 60 +" attrs="*,memberOf,pwdPolicySubentry,pwdChangedTime,pwdAccountLockedTime,pwdHistory,creatorsName,createTimestamp,modifiersName,modifyTimestamp" --- Nov 3 00:00:45 ldapmaster slapd[2308611]: syncrepl_message_to_entry: rid=016 DN: uid=user1,ou=accounts,dc=example,dc=org, UUID: db720f56-df0d-103c-8635-9543ccd6e97d Nov 3 00:00:45 ldapmaster slapd[2308611]: syncrepl_entry: rid=016 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid a0a89700 Nov 3 00:00:45 ldapmaster slapd[2308611]: syncrepl_entry: rid=016 be_search (0) Nov 3 00:00:45 ldapmaster slapd[2308611]: syncrepl_entry: rid=016 uid=user1,ou=accounts,dc=example,dc=org Nov 3 00:00:45 ldapmaster slapd[2308611]: syncrepl_null_callback : error code 0x14 Nov 3 00:00:45 ldapmaster slapd[2308611]: syncrepl_entry: rid=016 be_modify uid=user1,ou=accounts,dc=example,dc=org (20) Nov 3 00:00:45 ldapmaster slapd[2308611]: syncrepl_entry: rid=016 be_modify failed (20) Nov 3 00:00:45 ldapmaster slapd[2308611]: do_syncrepl: rid=016 rc 20 retrying SLAVE LDAP Server ================= database mdb [...] overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=example,dc=org" --- Nov 3 00:00:45 ldapslave slapd[2221506]: conn=176499 op=59513 SRCH base="uid=user1,ou=accounts,dc=example,dc=org" scope=0 deref=0 filter="(objectClass=*)" Nov 3 00:00:45 ldapslave slapd[2221506]: conn=176499 op=59513 SEARCH RESULT tag=101 err=0 nentries=1 text= Nov 3 00:00:45 ldapslave slapd[2221506]: conn=176500 op=59513 MOD dn="uid=user1,ou=accounts,dc=example,dc=org" Nov 3 00:00:45 ldapslave slapd[2221506]: conn=176500 op=59513 MOD attr=structuralObjectClass creatorsName createTimestamp userPassword pwdChangedTime memberOf entryCSN modifiersName modifyTimestamp Nov 3 00:00:45 ldapslave slapd[2221506]: conn=176500 op=59513 RESULT tag=103 err=20 text=modify/add: pwdHistory: value #0 already exists

3 4

Question regarding meta proxy server
by lists＠zxt10d.de 18 Nov '22

18 Nov '22

Hello list, I set-up a meta proxy server (hopefully that term is correct), to combine information from an AD-server and an ldap-server. For some reasons (historical?) both are running and provide mostly different attributes. In principle it seems to work, as I get information from both defined systems - but I don't get all information as there're not the same attributes on AD and ldap. For example, the unique userID on AD is "cn" and "sAMAccountName", on ldap its "uid". So, when doing a: ldapsearch "(uid=USERID)" -H ldap://metaldapserver... I will get information from the defined ldap-server only, and when doing a ldapsearch "(cn=USERID)" -H ldap://metaldapserver... I will get information from the defined AD-server only. Is there still a way to combine both infomation? Debian Bullseye with Symas OpenLDAP Server, slapd 2.6.3 Cheers, Torsten

3 3

SSSD looking for password policy: "unrecognized control"
by jarett＠bioteam.net 02 Nov '22

02 Nov '22

Hi, I am attempting to have SSSD do logins to my OpenLDAP 2.6.3 installation, however, I get "permission denied" when trying to log in because SSSD is asking for a password policy, which the server does not appear to have by default. Notably, we don't really care what "policy" the server will claim to have, because password authentication is delegated via SASL to another server which ensures strong passwords. So I just need something that will "get past" whatever checks SSSD is doing. What LDIF config can I add to my configuration to allow SSSD to let users log in properly? The error from `journalctl -u slapd` is shown below: Nov 01 18:16:58 ldapserver00 slapd[105481]: conn=2239 fd=11 ACCEPT from IP=10.8.8.202:41516 (IP=0.0.0.0:389) Nov 01 18:16:58 ldapserver00 slapd[105481]: conn=2239 op=0 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" Nov 01 18:16:58 ldapserver00 slapd[105481]: conn=2239 op=0 SRCH attr=* altServer namingContexts supportedControl supportedExtension supportedFeatures supportedLDAPVersion> Nov 01 18:16:58 ldapserver00 slapd[105481]: conn=2239 op=0 SEARCH RESULT tag=101 err=0 qtime=0.000020 etime=0.000271 nentries=1 text= Nov 01 18:16:58 ldapserver00 slapd[105481]: conn=2239 op=1 BIND dn="cn=admin,dc=clab,dc=lab" method=128 Nov 01 18:16:58 ldapserver00 slapd[105481]: slap_global_control: unrecognized control: 1.3.6.1.4.1.42.2.27.8.5.1 Nov 01 18:16:58 ldapserver00 slapd[105481]: conn=2239 op=1 BIND dn="cn=admin,dc=clab,dc=lab" mech=SIMPLE bind_ssf=0 ssf=0 Nov 01 18:16:58 ldapserver00 slapd[105481]: conn=2239 op=1 RESULT tag=97 err=0 qtime=0.000028 etime=0.000136 text= Nov 01 18:16:58 ldapserver00 slapd[105481]: get_filter: conn 2239 unknown attribute type=sudoHost (17) Nov 01 18:16:58 ldapserver00 slapd[105481]: get_ssa: conn 2239 unknown attribute type=sudoHost (17) Nov 01 18:16:58 ldapserver00 slapd[105481]: conn=2239 op=2 SRCH base="ou=users,dc=clab,dc=lab" scope=2 deref=0 filter="(&(?objectClass=sudoRole)(|(&(!(?sudoHost=*))(cn=de> Nov 01 18:16:58 ldapserver00 slapd[105481]: conn=2239 op=2 SRCH attr=objectClass objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs sudoRunAsUser sudoRunAs> Nov 01 18:16:58 ldapserver00 slapd[105481]: conn=2239 op=2 SEARCH RESULT tag=101 err=0 qtime=0.000016 etime=0.000326 nentries=0 text= TIA!

5 5

upgrading openldap 2.4 to 2.5
by CHIROSSEL, Olivier 02 Nov '22

02 Nov '22

Hi I have an architecture with 2 openldap masters in mirormode ( refreshAndPersist ). and few consumers ( refreshAndPersist ) The provisionning api and consumer request masters via vip ( sorry server configuration ), It's complex for me to upgrade all the openldap in the same operation. Can i upgrade only the 2 masters in 2.5, and the consumers in a second time ? The replication between master in 2.5 and consumers in 2.4 work's fine ? Thank's in advance for your replies. Regards Olivier

2 1

Two notes on slapppasswd (old version)
by Ulrich Windl 31 Oct '22

31 Oct '22

Hi! When using an old version (from 2.4.41) of slapasswd, I noticed two things: 1) Using "-h SSHA", slappasswd was asking for passwords first, then telling me: "Password generation failed for scheme SSHA: scheme not recognized" I think "SSHA" is unique enough to recognize; and if it's not, then complain before asking for passwords. 2) When I mistyped the option as "-h '{SSHA}>'", slappasswd did not complain and produce some output. I think if it's picky on the first case, it should also be for the second case (assuming the output "{SSHA}oTEDKWKn0fimGo6J8de0I5qRixGWJxhJ" was correct overall) Maybe check if these problems still exist in the current version. Regards, Ulrich Windl

2 1

LMDB, virtual machines, and copying mdb files
by selama＠gmail.com 29 Oct '22

29 Oct '22

I am working on developing a new document-oriented (XML+JSON) database, using LMDB as an engine, and I have two questions. 1. So far, it have been working really smoothly for me. But my one customer so far for the DB is really concerned about running LMDB in a virtual environment such as Docker, when performing reads and writes. Especially when mounting volumes. Their concern is because of the following caveat: "Do not use LMDB databases on remote filesystems, even between processes on the same host. This breaks flock() on some OSes, possibly memory map sync, and certainly sync between programs on different hosts" I think it shouldn't be an issue with Docker, but I want to be certain. 2. We have one server that updates the database, and another server with a read-only copy of the same database. Our plan was to simply copy the mdb files from the update machine to the read only machine, but we noticed that if we copy the file immediately after writing, the copy may end up being corrupted. My solution was to suspend all writing and wait few minutes before writing, to make sure everything back from memory, and I'm also using the "sync" command (not sure if it does anything here). It seem to be working, but I wonder if there is a more robust way of doing that? And also, is it safe to overwrite to the read-only server while it performs read transactions to the current file (or maybe rename it and copy to a new file with the same name)?

5 5

Read speeds, bottleneck, correct understanding?
by Sam Dave 27 Oct '22

27 Oct '22

Hi, If my program reads through an LMDB database apparently slow at first run, but suddenly runs much quicker at the second run (which does exactly the same thing), can't I already say with confidence that my choice of LMDB - in this case its builtin memory mapping functionality - is already paying off in terms of read speeds? I mean, that alone (exact same thing runs much faster the second time) already PROVES that the bottleneck was reading from disk as opposed to memory, right? I'm looking for excuses for patting myself on the back for investing in LMDB. Regards, Sam

2 3

cn=config TLS Configuration Problem
by Timothy Stonis 25 Oct '22

25 Oct '22

Hi, I am trying to setup an OpenLDAP 2.6.3 server and I’d like to only use olc configuration (no slapd.conf file). So far things are going okay, but I’m having a problem with TLS configuration. I am able to enable TLS using a self-signed certificate without any problem, however, if I try to disable TLS using the following LDIF: dn: cn=config changetype: modify delete: olcTLSCertificateFile - delete: olcTLSCertificateKeyFile - I get the following error: modifying entry "cn=config" ldap_modify: Server is unwilling to perform (53) I enabled debugging and cannot seem to see the error. I have also tried reordering the entries, doing one at a time, disabling ldaps:// binding, etc but nothing seems to work. If I just remove the certificate and/or key files, then the server does not start. Is enabling TLS a one way street? Or, should I just use slapd.conf? As a second question, I read in an article online that there is a way to store the TLS cert(s) and key in the LDAP database itself. However, I cannot find any info on that in the documentation. Can anyone shed some light on that? Thank you in advance! Tim

2 7

RE25 testing call (2.5.14)
by Quanah Gibson-Mount 25 Oct '22

25 Oct '22

This is the first testing call for OpenLDAP 2.5.14. Depending on the results, this may be the only testing call. Generally, get the code for RE25: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_5/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.5.14 Engineering Fixed client tools to remove 'h' and 'p' options (ITS#9917,ITS#8618) Fixed ldapsearch memory leak with controls (ITS#9860) Fixed libldap ldif_open_urlto check for failure (ITS#9904) Fixed libldap ldap_url_parsehosts check for failure (ITS#9904) Fixed slapd memory leak with olcAuthIDRewrite (ITS#6035) Fixed slapd transactions extended operations cleanup after write (ITS#9892) Fixed slapd-mdb max number of index databases to 256 (ITS#9895) Fixed slapd-monitor to free remembered cookies (ITS#9339) Fixed slapo-deref memory leak (ITS#9924) Fixed slapo-dynlist to ignore irrelevant objectClasses (ITS#9897) Fixed slapo-remoteauth memory leaks (ITS#9438) Build Environment Fixed build process to not use gmake specific features (ITS#9894) Fixed slapo-otp testdir creation (ITS#9437) Fixed slapd-tester memory leak (ITS#9908) Fixed usage of non-standard C syntax (ITS#9898, ITS#9899, ITS#9901) Fixed usage of bashism (ITS#9900) Documentation Fixed slapo-unique(5) to clarify when quoting should be used (ITS#9915) Regards, Quanah

5 9

Attribute Cert. schema (RFC 5755)
by Pascal Jakobi 21 Oct '22

21 Oct '22

Hi there I am looking for an RFC 5755 (attribute certificates profile) schema file. I thought it was in pmi.schema, but it appears that no, unless I am missing sthing. Before creating one from the RFC, I would like to be sure it does not exist somewhere I couldn't find. Thanks in adv. P

3 4

SyncRepl fails object class 'organization' requires attribute 'o'
by Sander Smeenk 21 Oct '22

21 Oct '22

Hi, I'm trying to set up SyncRepl between two servers. When the SyncRepl client connects and tries to start it logs: | Entry (dc=example,dc=nl): object class 'organization' requires attribute 'o' | syncrepl_null_callback : error code 0x41 | syncrepl_entry: rid=000 be_add dc=example,dc=nl failed (65) There is only one such entry in the db and it has an 'o' attribute: | dn: dc=example,dc=nl | objectClass: top | objectClass: dcObject | objectClass: organization | dc: example | o: example.nl | structuralObjectClass: organization | [ .. create, modify, entry uuids etc ..] What could i be missing here? Regards, -Sander. -- | Inside every older person is a younger person wondering what happened. | 4096R/20CC6CD2 - 6D40 1A20 B9AA 87D4 84C7 FBD6 F3A9 9442 20CC 6CD2

2 2

replacement of memberof by dynlist.. questions..
by Frédéric Goudal 19 Oct '22

19 Oct '22

Hello, We have to install a product which use ldap and that seems to need memberof overlay. As I have read this overlay is deprecated is cause trouble with replication. So I have dug to found a replacement solution, and what I have found is to add something like that : In the olcDynamicList olcDlAttrSet: myPerson labeledURI myMemberOf And in each user <user> : labeledURI: ldap:///ou=groups,dc=example,dc=com??sub?(&(objectclass=posixgroup) (memberuid=<user>)) I find this way quite heavy to deal with, adding such attribute to every user (1), but we can do it. My other problem is that the myMemberOf may be really long to compute at each request (and for stupid historic reason some old programs do qyery on the full user set of atttributes). So I intend to add a proxycache. But I have a questiion concerning the templates : if I add the following template (myMemberOf=*) will it cache only the requests that are exactly (myMemberOf=XXX) or requests that contains the pattern like (&(Status=xxx)(myMemberOf=yyy)) ? Thanks. f.g. Note 1 : it would be nice that we could define thinks like in a single place : labeledURI: ldap:///ou=groups,dc=example,dc=com??sub?(&(objectclass=posixgroup) (memberuid=%uid%)) where %uid% would be the uid attribute value of the considered object. Or do I miss solething ? — Frédéric Goudal Ingénieur Système, DSI Bordeaux-INP +33 556 84 23 11

2 3

Fwd: [OldapWS] -> Proposal of a REST Web Service for CRUD Operations
by Howard Chu 17 Oct '22

17 Oct '22

Forwarding for exposure - any interest? -------- Forwarded Message -------- Subject: [OldapWS] -> Proposal of a REST Web Service for CRUD Operations Date: Fri, 16 Sep 2022 13:21:10 +0200 From: Olivier CHATOR <olivier.chator15(a)gmail.com> To: openldap-devel(a)openldap.org Dear all, I am a "long time user" of OpenLDAP core parts. If the core is very stable, I often received some request from application developers, complaining about the lack of REST Web Service API to manipulate their Directory objects. Of course, as far as I could see, there is commercial solution available to do this, or even a project using Spring. But I could not see a simple proposal based on a simple Apache Server and "fully free" of rights. I also saw (https://www.openldap.org/devel/contributing.html) that "The OpenLDAP Project welcomes contributions of independently-developed stand-alone LDAP-related software packages suitable for distribution separately from existing packages (e.g., OpenLDAP Software, JLDAP, JDBC-LDAP)". Then, I would like to propose a full Open Source first realease of a CRUD REST Web Service to manipulate OpenLDAP's Directory Objects. I know that this first release is very limited in term of features, but I think it does the "core job", and may be a common base to be enriched to build a real OpenLDAP REST API ? Package available here: https://drive.google.com/drive/folders/1s4zlTleJ1JWhQWP2kLGHtTRofpWNevS7?us… Thanks for your time reading this proposal, do not hesitate to ask if you have any question. Kind regards, Olivier Chator

8 8

How to debug out of sync servers ?
by Frédéric Goudal 13 Oct '22

13 Oct '22

Hello, I have a kind of annoying problem with two openldap servers. It is a simple pair setup in delta-sync and multimaster althought modifications are actually always done on the same one. Version is 2.5.7 (well I know 2.6 is out but I can’t work as fast as openldap people). Several times a day the de-facto client is out of sync for several minutes. For example now I have a delta of about 50 minutes (usually it’s less), but the sync logs are very active here is some lines of the current operations Oct 12 16:03:24 ldap-renater3 slapd[1343]: do_syncrep2: rid=901 cookie=rid=901,sid=029,csn=20221012140303.663754Z#000000#029#000000 Oct 12 16:03:24 ldap-renater3 slapd[1343]: slap_queue_csn: queueing 0x7fa7278dd0e0 20221012140303.663754Z#000000#029#000000 Oct 12 16:03:24 ldap-renater3 slapd[1343]: syncrepl_message_to_op: rid=901 tid 0x7fa826062700 Oct 12 16:03:25 ldap-renater3 slapd[1343]: conn=-1 op=0 syncprov_matchops: recording uuid for dn=cn=elafont,ou=bordeaux-inp.fr,ou=mailboxes,dc=ipb,dc=fr on opc=0x7fa81002d008 Oct 12 16:03:25 ldap-renater3 slapd[1343]: conn=-1 op=0 syncprov_add_slog: adding csn=20221012140303.663754Z#000000#029#000000 to sessionlog, uuid=d4eaa120-c1e0-103b-88a5-0dec75f30866 Oct 12 16:03:25 ldap-renater3 slapd[1343]: conn=-1 op=0 syncprov_add_slog: expiring csn=20221007192836.067967Z#000000#029#000000 from sessionlog (sessionlog size=10000001) Oct 12 16:03:25 ldap-renater3 slapd[1343]: conn=-1 op=0 syncprov_add_slog: updating mincsn for sid=41 csn=20221007192836.058680Z#000000#029#000000 to 20221007192836.067967Z#000000#029#000000 Oct 12 16:03:25 ldap-renater3 slapd[1343]: slap_queue_csn: queueing 0x7fa7278d9d00 20221012140303.663754Z#000000#029#000000 Oct 12 16:03:25 ldap-renater3 slapd[1343]: conn=-1 op=0 syncprov_matchops: recording uuid for dn=reqStart=20221012140324.000068Z,cn=accesslog on opc=0x7fa81002dbf8 Oct 12 16:03:25 ldap-renater3 slapd[1343]: conn=39500 op=1 syncprov_matchops: skipping original sid 029 Oct 12 16:03:25 ldap-renater3 slapd[1343]: slap_graduate_commit_csn: removing 0x7fa7278d9d00 20221012140303.663754Z#000000#029#000000 Oct 12 16:03:25 ldap-renater3 slapd[1343]: slap_graduate_commit_csn: removing 0x7fa7278dd0e0 20221012140303.663754Z#000000#029#000000 Oct 12 16:03:25 ldap-renater3 slapd[1343]: syncrepl_message_to_op: rid=901 be_modify cn=elafont,ou=bordeaux-inp.fr,ou=mailboxes,dc=ipb,dc=fr (0) Oct 12 16:03:25 ldap-renater3 slapd[1343]: slap_queue_csn: queueing 0x7fa7278de470 20221012140303.663754Z#000000#029#000000 Oct 12 16:03:25 ldap-renater3 slapd[1343]: slap_graduate_commit_csn: removing 0x7fa7278de470 20221012140303.663754Z#000000#029#000000 The behaviour that seems to occurs is that the logging sometimes stop (nothing more to do it seems) and when it stops the servers are in sync. So it seems the sync operations are very slow. Of course I do not log on normal operation. The directory as something like 70k entries (180Mb for the mdb file). Servers have plenty of memory : free total used free shared buff/cache available Mem: 8148668 3445380 125972 500 4577316 4390168 Swap: 2009084 183552 1825532 Servers are on an vmware cluster, from the vmware point of view cpu usage is very low. OS is ubuntu 20.04 I don’t know where to dig... Thanks in advance — Frédéric Goudal Ingénieur Système, DSI Bordeaux-INP +33 556 84 23 11

3 3

Fwd: RE25 testing call (2.5.14)
by Lucio De Re 10 Oct '22

10 Oct '22

As requested by Quanah. If no other practical measure is available, the server I'm using can be accessed via SSH. I'll supply further details in return for an SSH-format public key and essential identification. Lucio. -------- Forwarded Message -------- Subject: Re: RE25 testing call (2.5.14) Date: Fri, 7 Oct 2022 18:53:42 +0200 From: Lucio De Re <lucio(a)ff.co.za> Organization: Future Foundation To: Quanah Gibson-Mount <quanah(a)fast-mail.org> On 2022/10/04 18:50, Quanah Gibson-Mount wrote: > This is the first testing call for OpenLDAP 2.5.14. Depending on the > results, this may be the only testing call. > > Generally, get the code for RE25: > > <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_5/o…> > > > Extract, configure, and build. > > Execute the test suite (via make test) after it is built. Optionally, > cd tests && make its to run through the regression suite. > > Thanks! > On NetBSD 9.1... NetBSD jackal.proxima.alt.za 9.1 NetBSD 9.1 (GENERIC) #0: Sun Oct 18 19:24:30 UTC 2020 mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/i386/compile/GENERIC i386 Fri 07 Oct 2022 18:51:30 SAST ... >>>>> Starting test049-sync-config for mdb... running defines.sh Starting provider slapd on TCP/IP port 9011... Using ldapsearch to check that provider slapd is running... Inserting syncprov overlay on provider... Starting consumer slapd on TCP/IP port 9012... Using ldapsearch to check that consumer slapd is running... Configuring syncrepl on consumer... Waiting 7 seconds for syncrepl to receive changes... Using ldapsearch to check that syncrepl received config changes... Adding schema and databases on provider... Using ldapadd to populate provider... Waiting 7 seconds for syncrepl to receive changes... Using ldapsearch to check that syncrepl received database changes... Replacing olcSyncrepl on provider... Waiting 7 seconds for syncrepl to receive changes... Using ldapsearch to read config from the provider... Using ldapsearch to read config from the consumer... Filtering provider results... Filtering consumer results... Comparing retrieved configs from provider and consumer... Using ldapsearch to read all the entries from the provider... Using ldapsearch to read all the entries from the consumer... Filtering provider results... Filtering consumer results... Comparing retrieved entries from provider and consumer... >>>>> Test succeeded >>>>> test049-sync-config completed OK for mdb after 27 seconds. >>>>> Starting test050-syncrepl-multiprovider for mdb... running defines.sh Initializing server configurations... Starting server 1 on TCP/IP port 9011... Using ldapsearch to check that server 1 is running... Inserting syncprov overlay on server 1... Starting server 2 on TCP/IP port 9012... Using ldapsearch to check that server 2 is running... Configuring syncrepl on server 2... Starting server 3 on TCP/IP port 9013... Using ldapsearch to check that server 3 is running... Configuring syncrepl on server 3... Starting server 4 on TCP/IP port 9014... Using ldapsearch to check that server 4 is running... Configuring syncrepl on server 4... Adding schema and databases on server 1... Using ldapadd to populate server 1... Waiting 15 seconds for syncrepl to receive changes... Using ldapsearch to read config from server 1... Using ldapsearch to read config from server 2... Using ldapsearch to read config from server 3... ... It's been hanging at this point for quite a while. There were no build or compilation errors that I could notice. Lucio.

1 0

Can't query contextCSN ?
by Sander Smeenk 07 Oct '22

07 Oct '22

Hi, I have one master, one slave LDAP server. Syncprov is active and running. On the master or the slave (2.5), if i `slapcat` i get: | dn: dc=example,dc=nl | objectClass: top | objectClass: dcObject | objectClass: organization | o: example | dc: example | structuralObjectClass: organization | entryUUID: f55086bc-adb9-103c-9c47-456ab09d92ea | creatorsName: cn=admin,dc=example,dc=nl | createTimestamp: 20220811120747Z | entryCSN: 20220811120747.388919Z#000000#000#000000 | modifiersName: cn=admin,dc=example,dc=nl | modifyTimestamp: 20220811120747Z | contextCSN: 20221007075756.114574Z#000000#000#000000 | | [ .. ] So there is a 'contextCSN' in there, but i can't seem to query it: | # ldapsearch -xLLL -H ldaps://127.0.0.1 -b 'dc=example,dc=nl' -s 'base' contextCSN | dn: dc=example,dc=nl | | # While on a different set of servers (2.4), that ldapsearch does work: | # ldapsearch -xLLL -H ldap://127.0.0.1 -b 'dc=anotherexample,dc=nl' -s 'base' contextCSN | dn: dc=anotherexample,dc=nl | contextCSN: 20221007080803.057248Z#000000#000#000000 | | # What could be wrong here? Regards, -Sander. -- | On the other hand, you have different fingers. | 4096R/20CC6CD2 - 6D40 1A20 B9AA 87D4 84C7 FBD6 F3A9 9442 20CC 6CD2

1 1

RE26 testing call #1 (2.6.4)
by Quanah Gibson-Mount 06 Oct '22

06 Oct '22

This is the first testing call for OpenLDAP 2.6.4. Depending on the results, this may be the only testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.6.4 Engineering Fixed client tools to remove 'h' and 'p' options (ITS#9917,ITS#8618) Fixed ldapsearch memory leak with controls (ITS#9860) Fixed libldap ldif_open_urlto check for failure (ITS#9904) Fixed libldap ldap_url_parsehosts check for failure (ITS#9904) Fixed lloadd memory leaks (ITS#9907) Fixed lloadd shutdown code to protect memory correctly (ITS#9913) Fixed slapd memory leak with olcAuthIDRewrite (ITS#6035) Fixed slapd free of config item (ITS#9912) Fixed slapd transactions extended operations cleanup after write (ITS#9892) Fixed slapd-mdb max number of index databases to 256 (ITS#9895) Fixed slapd-monitor memory leaks with lloadd (ITS#9906) Fixed slapd-monitor to free remembered cookies (ITS#9339) Fixed slapo-deref memory leak (ITS#9924) Fixed slapo-dynlist to ignore irrelevant objectClasses (ITS#9897) Fixed slapo-remoteauth memory leaks (ITS#9438) Fixed slapo-rwm memory leaks (ITS#9817) Build Environment Fixed build process to not use gmake specific features (ITS#9894) Fixed slapo-otp testdir creation (ITS#9437) Fixed slapd-tester memory leak (ITS#9908) Fixed usage of non-standard C syntax (ITS#9898, ITS#9899, ITS#9901) Fixed usage of bashism (ITS#9900) Documentation Fixed slapo-unique(5) to clarify when quoting should be used (ITS#9915) Regards, Quanah

4 3

LMDB key marshalling functions
by Søren Holm 28 Sep '22

28 Sep '22

Hi I am working on utilizing LMDB in a project of mine. However I am struggling a bit on how to manage marshalling of keys. - packing of C structure into array - and unpacking - handling parrtial keys for range traversals. Som months ago I read an article named "Shine and poverty key value database LMDB in applications for iOS". It contained some clever techniques. However the article is not longer to be found. I feel like if I do the handling in a wrong way it will be a nightmare. How to you handling your keys? /Søren Holm

1 0

slapo constraint - uri constraint on object DN
by Benjamin Renard 27 Sep '22

27 Sep '22

Hello, I try to affect an uri constraint on an attribute that storing the DN of another object but I don't know what I have to put on the attribute field of the URI. Have any of you already implemented such a constraint? Constraint example for a attribute that storing another attribute value: olcConstraintAttribute: title uri ldap:///dc=catalog,dc=example,dc=com?title?sub?(objectClass=titleCatalog) Thank you in advance, -- Benjamin Renard - Easter-eggs 44-46 rue de l'Ouest - 75014 Paris - France - Métro Gaité Phone: +33 (0) 1 43 35 00 37 - mailto:brenard@easter-eggs.com

2 2

how to add index in replication scenario
by Uwe Sauter 17 Sep '22

17 Sep '22

Dear list, I need to add an index for a new attribute in an active-active replication scenario. I know I need to run slapindex to create the index for existing entries after I changed the configuration file (yes, still on 2.4 with slapd.conf). But what is the correct procedure to update both servers? I'm a bit worried that the setup will become out-of-sync if I just update one server at a time. Would it be better to stop the service on both servers and re-index the databases at the same time before going online again? Regards, Uwe

4 8

no accesslog record on "delete" sync state control
by Zeus Panchenko 13 Sep '22

13 Sep '22

hi I face a weird situation with my LDAP syncrepl consumer [1], please advise ... on "delete" sync state control receiving, I'm trying to search for accesslog object with the just deleted object to use it in further processing, but it is not available yet though if I set delay (sleep) for 1 sec just before the search, then I successfully receive the object so, is it intended behavior? here is this search: https://github.com/z-eos/regather/blob/master/lib/App/Regather.pm#L439 [1] https://github.com/z-eos/regather -- Zeus V. Panchenko . jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC ..: GMT+2 (EET)

2 1

Re: Antw: [EXT] Re: LMDB 1.0 data.mdb format stability
by Howard Chu 09 Sep '22

09 Sep '22

Ulrich Windl wrote: >>>> Howard Chu <hyc(a)symas.com> schrieb am 08.09.2022 um 01:34 in Nachricht > <4bc80e7e-17f9-b385-6b11-2aab806edc43(a)symas.com>: >> Steffen Michels wrote: >>> Hi, >>> >>> We are considering using the mdb.master3 branch of LMDB, but it is not clear >> to me whether the data.mdb format will remain stable. Is there a chance that >>> another migration of all databases will be required in the future when >> switching now? >> >> Yes. It is still unreleased because additional changes to the freelist >> format are planned, >> and possibly a few other changes. >> >> In any case, mdb_dump/mdb_load will always work for migrating to a new >> version. > > I think at some point an inplace upgrade would be the way to go. > On Linux filesystems, you could even upgrade yout ext3 to btrfs ;-) That will never happen here. Supporting an in-place upgrade requires the library to support old and new formats simultaneously, which is a waste of RAM. Anything that pushes the object code size of the hot path over 64KB is a non-starter. > > Regards, > Ulrich > >> >>> >>> regards, >>> >>> Steffen >> >> >> -- >> -- Howard Chu >> CTO, Symas Corp. http://www.symas.com >> Director, Highland Sun http://highlandsun.com/hyc/ >> Chief Architect, OpenLDAP http://www.openldap.org/project/ > > > > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

4 7

LMDB 1.0 data.mdb format stability
by Steffen Michels 08 Sep '22

08 Sep '22

Hi, We are considering using the mdb.master3 branch of LMDB, but it is not clear to me whether the data.mdb format will remain stable. Is there a chance that another migration of all databases will be required in the future when switching now? regards, Steffen

2 1

RE: Openldap policy not working on Ubuntu 22.04
by Mehmet Sağdıç 06 Sep '22

06 Sep '22

Hi, Is there anyone who can help on this issue? -- -- -- -- -- İyi Çalışmalar -- -- -- Mehmet Sağdıç Technical Support Expert | Computer Center Directorate +90 (392) 671 11 11 | 2829 - Gsm : 0548 858 95 43 <https://ciu.edu.tr/> Cyprus International University <https://www.facebook.com/CIUOfficial> <https://www.instagram.com/ciu.official/> <https://twitter.com/CIUOfficial> <https://www.youtube.com/user/uluslararasikibris> <https://www.linkedin.com/company/cyprus-international-university> <https://scholar.google.com/citations?view_op=view_org&hl=tr&org=39727957745 3037268> From: Mehmet Sağdıç [mailto:msagdic@ciu.edu.tr] Sent: Monday, August 22, 2022 4:30 PM To: 'openldap-technical(a)openldap.org' Subject: Openldap policy not working on Ubuntu 22.04 Hi, I am using openldap version 2.4.49 on ubuntu 20.04. I did the ubuntu 20.04 - 22.04 version update from the command line using the address below. <https://jumpcloud.com/blog/how-to-upgrade-ubuntu-20-04-to-ubuntu-22-04> https://jumpcloud.com/blog/how-to-upgrade-ubuntu-20-04-to-ubuntu-22-04 After the Ubuntu 22.04 update was finished, the Ldap version automatically changed to the openldap version 2.5.12 and the ldap service did not work. I made the Ldap service run by doing the following: <https://discourse.ubuntu.com/t/service-migrating-from-openldap-2-4-x-to-2-5 -x/23807> https://discourse.ubuntu.com/t/service-migrating-from-openldap-2-4-x-to-2-5- x/23807 But I saw that there is no policy.ldif in cn=config and the policy does not take action. The ldap service is running, but the policy is not working. How can I run policy on Openldap version 2.5.12.

2 1

Q: "Error: Invalid DN syntax (34), additional info: invalid new RDN"
by Ulrich Windl 30 Aug '22

30 Aug '22

Hi! I'm programming some automated changes to our LDAP database, and I have an issue: # Error: Invalid DN syntax (34), additional info: invalid new RDN dn: cn=subntbcst_tftp@247/tcp,dc=services,dc=net,dc=...,dc=de changetype: modrdn newrdn: subntbcst-tftp@247/tcp deleteoldrdn: 1 So is the new RDN "subntbcst-tftp@247/tcp" really invalid? If so it seems an older version of OpenLDAP accepted that as we have such an entry: dn: cn=subntbcst_tftp@247/tcp,dc=services,dc=net,dc=...,dc=de objectClass: ipService cn: subntbcst_tftp cn: subntbcst_tftp@247/tcp createTimestamp: 20130719093351Z ... I saw this exaple in RFC 2849 (so I thought my LDIF shuld be OK): # Modify an entry’s relative distinguished name dn: cn=Paul Jensen, ou=Product Development, dc=airius, dc=com changetype: modrdn newrdn: cn=Paula Jensen deleteoldrdn: 1 Regards, Ulrich

3 5

measurable slower result time with large subtree
by Norbert 26 Aug '22

26 Aug '22

Hi, with OpenLDAP 2.4.47 (running on Debian 10) but also with 2.5.13 from ltb-project.org (running on same Debian 10) I can observe the following: given following rough idea of a tree o=base |- bn=subtree1 | - handful of entries |- bn=subtree2 | - millions of entries |- bn=subtree3 | |- bn=sub-subtree1 | |- bn=sub-subtree2 | |- some entries |- bn=subtree4 ou is an indexed attribute with pres,eq,sub. When now searching with the filter bn=<value> then there is a significant difference when searching for either subtree1 and subtree2 as values in the range of seconds. This means on command line ldapsearch with subtree1 it is around 0.007 seconds and with subtree2 4.5 seconds before the fully finishes. When I change the search filter to "(&(objectClass=bnClass)(bn=<value>))" then this has no real impact to the time needed searching for subtree1 but improves searching subtree2, still it more than 2 times slower than searching for subtree1. Only entries with objectClass=bnClass have the bn attribute but no other entries. Changing the scope to one, yields similar times when searching for subtree1 and subtree2 but the search itself also to cover searching for sub-subtree1 or sub-subtree2 with the same search task as it is not known where such sub-subtree could be found. The only pattern I've found so far is that if there are millions of entries in a subtree then finishing the search takes much longer. The LDAP is using MDB, and has been completely rebuilt (means slapcat/slapadd) several times with always showing the same results. There was no difference between 2.4 and 2.5.13. Is there something which can be improved by changing the configuration? Thanks, Norbert

3 3

pcache makes slapd die after some seconds
by Norbert 25 Aug '22

25 Aug '22

Hi, when trying to use the pcache overlay for an MDB database instance, it seems to work, at least some first test search seem to be significantly improved but then the slapd process without anything in the logs (no segfault at least). Unfortunately it is not possible to restart the slapd process either, as it also soon dies after starting. The config used looks something like the following: dn: olcOverlay={0}pcache,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcPcacheConfig olcOverlay: {0}pcache olcPcache: mdb 1000 1 1000 100 olcPcacheAttrset: 0 bn attribute1 attribute2 objectClass olcPcacheTemplate: "(&(|(objectClass=)(objectClass=))(bn=))" 0 120 olcPcacheTemplate: "(bn=)" 0 120 dn: olcDatabase={0}mdb,olcOverlay={0}pcache,olcDatabase={1}mdb,cn=config objectClass: olcMdbConfig objectClass: olcPcacheDatabase olcDatabase: {0}mdb olcDbDirectory: /data/pcache olcDbIndex: objectClass eq olcDbIndex: bn pres,eq,sub Is pcache supposed to work as an overlay for mdb database? Or does it only work with an ldap backend db? Thanks, Norbert

2 2

ipService anyone?
by Ulrich Windl 24 Aug '22

24 Aug '22

Hi! Several years ago I added ipService to our LDAP Database, then I thought it's time to update it. Now I have a conceptual problem: Some services have multiple protocols and port numbers. For example "compressnet". While it's possible to assign unique names like cn=compressnet@2/tcp,... cn=compressnet@2/tcp,... cn=compressnet@3/tcp,... cn=compressnet@3/udp,... I wonder how a standard query for "compressnet" should look like. Basically I'd like to leave out the port (@n), but the IANA registry is not unique. I identified these: compressnet mit-ml-dev sql-net rap meter pip csdmbase csdm nmsp uma raid-cd ... optohost004 It seems ipService can have multiple values for ipServiceProtocol, cn, and ipServiceProtocol, but wouldn't that silently assume that all port numbers are valid for all listed protocols? For the example it would be any combination of (UDP,TCP) and (2,3). To me the only solution seems to force IANA to clean up the mess. RFC-6335/BCP-165 claims: "Service names are the unique key in the Service Name and Transport Protocol Port Number registry." (page 8) Opinions? Regards, Ulrich

1 0

Empty error when configuring OpenLDAP
by Cezary Drożak 23 Aug '22

23 Aug '22

Hello, I am trying to set up OpenLDAP on Arch Linux on my server, following instruction on Arch Wiki[1]. I prepared the config.ldif file, replacing every $BASEDN and $PASSWD in the example configuration: # The root config entry dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /run/openldap/slapd.args olcPidFile: /run/openldap/slapd.pid # Schemas dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema # TODO: Include further schemas as necessary include: file:///etc/openldap/schema/core.ldif # The config database dn: olcDatabase=config,cn=config objectClass: olcDatabaseConfig olcDatabase: config olcRootDN: cn=Manager,dc=example,dc=com # The database for our entries dn: olcDatabase=mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: mdb olcSuffix: dc=example,dc=com olcRootDN: cn=Manager,dc=example,dc=com olcRootPW: {SSHA}xZqSQN4wG4+C5I57dB/Qm02vJ+kQcwd7 olcDbDirectory: /var/lib/openldap/openldap-data # TODO: Create further indexes olcDbIndex: objectClass eq Then I executed the following command: sudo -u ldap slapadd -n 0 -F /etc/openldap/slapd.d/ -l ./config.ldif This gave me the following error: invalid config directory /etc/openldap/slapd.d/, error 2 slapadd: bad configuration directory! I checked that the directory did not exist, so I created it and changed owner to `ldap`. The wiki page did not mention that the directory should be created earlier, so maybe it should have been created by a post installation script. If that's the case, I will report it to package maintainers. After I created the directory, I ran the command again, this time having a different error message: slapadd: could not add entry dn="cn=config" (line=1): Closing DB... I have no idea what is wrong now and I cannot find anything useful on the internet. Does anyone have an idea what I may be doing wrong here? [1]: https://wiki.archlinux.org/title/OpenLDAP

3 4

slapo-variant and searching virtual attrs
by Michael Ströder 23 Aug '22

23 Aug '22

HI! I have the need to search a whole sub-tree for something like collective attributes which AFAIK slapo-collect does not support. Now I'm wondering whether it's possible to search for the virtual attributes generated by slapo-variant. And probably I'd like to use the regex variant. I've read the section LIMITATIONS in slapo-variant(5) which says that regex variants only support reading the virtual attributes with scope base. It also implies that searching for these virtual attributes is not possible at all. Is that correct? Ciao, Michael.

2 1

using memberof to authenticate Linux with PAM
by Alceu Rodrigues de Freitas Junior 22 Aug '22

22 Aug '22

Greetings, For a matter of studying OpenLDAP, I decided to create a CLI in Golang that is based on the migrationtools (https://gitlab.com/future-ad-laboratory/migrationtools), which is written in Bash and (very old) Perl code. All the Golang module is available here: https://github.com/glasswalk3r/aprendendo-openldap/tree/main/migration. After learning about the memberof overlay, I've being wondering if it is possible to use it to maintain the UNIX groups at /etc/group instead of just replicating the same information over an over. I've tried to find references in the documentation of using PAM and NSCD in the Linux clients for authenticating from a OpenLDAP server, but found nothing regarding those requirements, neither a detailed explanation (without resorting looking into the source code) of how those requests from a Linux client would be sent to OpenLDAP in order to check that. If any has any pointers on the subject, I would be glad to receive them. Thanks in advance, Alceu

3 7

Proxying an insecure LDAP and authenticate using another
by Kevin Olbrich 22 Aug '22

22 Aug '22

Hi! I have a case where I got access to a read-only LDAP that has no authentication (everything is public). It is located in a secure and trusted environment. Now I want to expose the directory to another network and like to add authentication but can not add it to the source (proprietary software). I need to proxy this server and authenticate the users using active directory. I know how to proxy AD including passthrough authentication but can I proxy another directory and authenticate using another? If yes, how? Thank you very much. Kind regards Kevin Olbrich

1 0

Re: Pass-through
by Stéphane Veyret 20 Aug '22

20 Aug '22

Could it be that the SASL global configuration (also given in first message) is wrong? I only set those 2 options: olcSaslHost: localhost olcSaslSecProps: none

2 4

Re: Error: Could not locate TLS/SSL package
by Jeffrey Walton 17 Aug '22

17 Aug '22

On Wed, Aug 17, 2022 at 12:16 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > --On Wednesday, August 17, 2022 2:11 PM +0530 Vijay Maidarkar > <vmaidarkar(a)gmail.com> wrote: > > Hi, please keep replies on the list. > > Find below answers. > > > > Where is it installed? > > $ which openssl > > > > /usr/local/bin/openssl > > > > $ ldd /usr/local/bin/openssl > > linux-vdso.so.1 => (0x00007fff931e6000) > > libssl.so.1.1 => /lib64/libssl.so.1.1 (0x00007f7f7a570000) > > libcrypto.so.1.1 => /lib64/libcrypto.so.1.1 (0x00007f7f7a087000) > > libdl.so.2 => /lib64/libdl.so.2 (0x00007f7f79e83000) > > libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f7f79c67000) > > libc.so.6 => /lib64/libc.so.6 (0x00007f7f79899000) > > /lib64/ld-linux-x86-64.so.2 (0x00007f7f7a802000) > > > > How was it installed? > > I've downloaded the archive & done compilation from below cmds. > > > > $ ./config > > $ make > > $ make install There are other options you should be using for OpenSSL. At minimum, you probably want enable-ec_nistp_64_gcc_128 on x86_64. Also see https://wiki.openssl.org/index.php/Compilation_and_Installation#Configure_O… . > So, you built it yourself so there will be no development package. I'm not > sure why you built such an ancient version of OpenSSL (you listed OpenSSL > 1.1.1g when 1.1.1q is the most recent), since it's vulnerable to multiple > critical CVEs. > > I'd strongly advise using the packages from EPEL if you insist on staying > on CentOS7 (which is near end of life). > > If you are going to use your own OpenSSL build, I can't emphasize enough > the importance of using a current release. Since you're doing this in an > unpackaged way, maintenance is going to be a nightmare. > > Since you've built it yourself into its own location, you have to tell the > configure script where to find the development headers, like: > > CPPFLAGS="/usr/local/include" LDFLAGS="-L/usr/local/lib > -Wl,-rpath,/usr/local/lib" ./configure ... +1 for the RPATH. Linux (and other OSes) have a (mis)feature of building against one version of a library, and runtime linking against another version of the library. Be sure to specify the RPATH to avoid the bug. (If you want to see the effects of linking against the wrong library at runtime, see https://www.openwall.com/lists/oss-security/2020/07/20/1). Nowadays on Linux you should specify a RUNPATH, not a RPATH. The RUNPATH allows LD_LIBRARY overrides to search paths. It is recommended by the folks who write the runtime loaders. The options you need are: * -Wl,-rpath,<lib path> (enables RPATH) * -Wl,--enable-new-dtags (enables RUNPATH) Jeff

2 1

Re: Error: Could not locate TLS/SSL package
by Quanah Gibson-Mount 17 Aug '22

17 Aug '22

--On Wednesday, August 17, 2022 2:11 PM +0530 Vijay Maidarkar <vmaidarkar(a)gmail.com> wrote: > > > > > Hi Quanah, Hi, please keep replies on the list. > Find below answers. > > Where is it installed? > $ which openssl > > /usr/local/bin/openssl > > $ ldd /usr/local/bin/openssl > linux-vdso.so.1 => (0x00007fff931e6000) > libssl.so.1.1 => /lib64/libssl.so.1.1 (0x00007f7f7a570000) > libcrypto.so.1.1 => /lib64/libcrypto.so.1.1 (0x00007f7f7a087000) > libdl.so.2 => /lib64/libdl.so.2 (0x00007f7f79e83000) > libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f7f79c67000) > libc.so.6 => /lib64/libc.so.6 (0x00007f7f79899000) > /lib64/ld-linux-x86-64.so.2 (0x00007f7f7a802000) > > How was it installed? > I've downloaded the archive & done compilation from below cmds. > > $ ./config > $ make > $ make install So, you built it yourself so there will be no development package. I'm not sure why you built such an ancient version of OpenSSL (you listed OpenSSL 1.1.1g when 1.1.1q is the most recent), since it's vulnerable to multiple critical CVEs. I'd strongly advise using the packages from EPEL if you insist on staying on CentOS7 (which is near end of life). If you are going to use your own OpenSSL build, I can't emphasize enough the importance of using a current release. Since you're doing this in an unpackaged way, maintenance is going to be a nightmare. Since you've built it yourself into its own location, you have to tell the configure script where to find the development headers, like: CPPFLAGS="/usr/local/include" LDFLAGS="-L/usr/local/lib -Wl,-rpath,/usr/local/lib" ./configure ... However, I would again strongly advise you not go the route of building the software yourself unless you're going to do it in a packaged way (I.e. make RPMs) so that you can upgrade whenever there's a new vulnerability. Even more, I'd strongly advise just using the pre-built packages provided by either Symas (Which offers current builds of both OpenLDAP 2.5 and OpenLDAP 2.6 + supporting libraries) or the LTB project. <https://repo.symas.com/> <https://ltb-project.org/> Regards, Quanah

1 0

Error: Could not locate TLS/SSL package
by vmaidarkar＠gmail.com 16 Aug '22

16 Aug '22

Hi Team, I'm compiling OpenLDAP 2.5.13 on CentOS 7 & OpenSSL 1.1.1g is already installed & below is the command. ./configure --prefix=/opt/deployment/openldap_v13 --sysconfdir=/opt/deployment/openldap_v13/etc --localstatedir=/opt/deployment/openldap_v13/var --libexecdir=/opt/deployment/openldap_v13/libexec --enable-overlays=mod --enable-modules --enable-accesslog --enable-auditlog --enable-collect --enable-memberof --enable-syncprov --with-tls=openssl --enable-dynamic --enable-crypt --enable-slapd --enable-rlookups --disable-perl --enable-ppolicy --enable-backends=mod --disable-ndb --disable-sql --disable-shell --disable-bdb --disable-hdb I'm getting the below error of OpenSSL. checking for openssl/ssl.h... yes checking for SSL_export_keying_material_early in -lssl... no configure: error: Could not locate TLS/SSL package Could you please suggest how to fix this issue. Thanks, Vijay

4 6

Unable to connect to 636 secure port using LDAP library
by BANDANI MAHARANA 15 Aug '22

15 Aug '22

Hi Team, I am trying to connect to an Active directory server using 636 port for secure connection. I am using the openldap library to establish the connection. Implementation is completed for insecure connection using 389 port. Below is the code snippet I am using to establish the connection with ldap server in 636 port. LDAP * ldap_handler; int return_value = ldap_initialize(ldap_handler, "ldaps:// TestServer.mylab.com:636"); //server url if (return_value == LDAP_SUCCESS) { cout<<"LDAP initialized successfully"; // this is successful for me } else { cout<<"LDAP initialization failed"; } int return_value = ldap_set_option(*ldap_handler, LDAP_OPT_PROTOCOL_VERSION, LDAP_VERSION3); if(return_value == LDAP_SUCCESS) { cout<<"success"; // this is successful for me } else { cout<<"failed"; } const char * CACERT_FILE_PATH = "certificate/mylab-TESTSERVER-CA.cer"; //certificate path int return_value1 = ldap_set_option(*ldap_handler, LDAP_OPT_X_TLS_CACERTFILE, CACERT_FILE_PATH); if (return_value1 == LDAP_SUCCESS) { } else { // its failing here with error -1, and error string "Can't contact to LDAP server" } int return_value = ldap_simple_bind_s(*ldap_handler, "mylab\administrator", ""pwd@1234"); if (return_value == LDAP_SUCCESS) { //success } else { // its failing here with error -1, and error string "Can't contact to LDAP server" } I have verified the same thing is working when connecting to 389 port. Could you please suggest how to make this work for secure ldap connection over ssl? Please provide some examples or references. It will be helpful for me. Thanks & Regards, Bandani

3 4

LDAP Failure: {'desc': "Can't contact LDAP server}
by Shaheena Kazi 08 Aug '22

08 Aug '22

Hello, I am using Debian 11. Openldap : 2.4.57+dfsg-3+deb11u1 python3-ldap : 3.2.0-4+b3 python3-ldap3: 2.8.1-1 TLS - 1.3 Openssl - 1.1.1n-0+deb11u3 I am try to set a new connect and then import files using below commands: ldapcon = ldap.initialize('ldap://localhost') ldapcon.set_option(ldap.OPT_PROTOCOL_VERSION, ldap.VERSION3) ldapcon.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_NEVER) ldapcon.set_option(ldap.OPT_X_TLS_NEWCTX, 0) dn_to_add = 'cn=test.user,ou=people,dc=framework,dc=protegrity,dc=com' modlist_to_add = [('uid', [b'test.user']), ('objectclass', [b'inetOrgPerson', b'posixAccount', b'top']), ('uidnumber', [b'1003']), ('gidnumber', [b'100']), ('homedirectory', [b'/home/test.user']), ('userpassword', [b'qwer1234']), ('givenname', [b'test']), ('sn', [b'user']), ('displayname', [b'test user']), ('loginshell', [b'/usr/local/sbin/manager']), ('cn', [b'test.user']), ('description', [b'testing']), ('pwdreset', [b'TRUE'])] ********* But when I run this - ldapcon.add_s(dn_to_add, modlist_to_add) The slapd service crashes and I get below error LDAP Failure: {'desc': "Can't contact LDAP server} ldap.CONFIDENTIALITY_REQUIRED: {'desc': 'Confidentiality required', 'info': 'TLS confidentiality required'} Can u guys help me here as in what am I missing on and why the add_s is causing my slapd to crash Regards, Shaheena K

2 1

symas pacakages on Debian
by Ulf Volmer 05 Aug '22

05 Aug '22

Hello, I'm running symas OpenLDA on Debian 11. Today we got an upgrade, which make the server unable to start: apt show symas-openldap-server Package: symas-openldap-server Version: 2.6.3-1bullseye1 sudo systemctl status slapd ● symas-openldap-server.service - Symas OpenLDAP Server Daemon Loaded: loaded (/etc/systemd/system/symas-openldap-server.service; enabled; vendor preset: enabled) Drop-In: /etc/systemd/system/symas-openldap-server.service.d └─override.conf /run/systemd/system/service.d └─zzz-lxc-service.conf Active: failed (Result: exit-code) since Fri 2022-08-05 13:20:57 CEST; 8min ago Docs: man:slapd man:slapd-config man:slapd-mdb Process: 536 ExecStart=/opt/symas/lib/slapd -d 0 -h ${SLAPD_URLS} $SLAPD_OPTIONS (code=exited, status=254) Main PID: 536 (code=exited, status=254) CPU: 13ms Aug 05 13:20:57 ldap3.lan.u-v.de systemd[1]: Starting Symas OpenLDAP Server Daemon... Aug 05 13:20:57 ldap3.lan.u-v.de slapd[536]: ldap_int_sasl_init: SASL library version mismatch: expected 2.1.28, got 2.1.27 Aug 05 13:20:57 ldap3.lan.u-v.de systemd[1]: symas-openldap-server.service: Main process exited, code=exited, status=254/n/a Aug 05 13:20:57 ldap3.lan.u-v.de systemd[1]: symas-openldap-server.service: Failed with result 'exit-code'. Aug 05 13:20:57 ldap3.lan.u-v.de systemd[1]: Failed to start Symas OpenLDAP Server Daemon. dpkg -l|grep sasl ii gsasl-common 1.10.0-4+deb11u1 all GNU SASL platform independent files ii libgsasl7:amd64 1.10.0-4+deb11u1 amd64 GNU SASL library ii libsasl2-2:amd64 2.1.27+dfsg-2.1+deb11u1 amd64 Cyrus SASL - authentication abstraction library ii libsasl2-modules:amd64 2.1.27+dfsg-2.1+deb11u1 amd64 Cyrus SASL - pluggable authentication modules ii libsasl2-modules-db:amd64 2.1.27+dfsg-2.1+deb11u1 amd64 Cyrus SASL - pluggable authentication modules (DB) ii libsasl2-modules-gssapi-mit:amd64 2.1.27+dfsg-2.1+deb11u1 amd64 Cyrus SASL - pluggable authentication modules (GSSAPI) rc sasl2-bin 2.1.27+dfsg-2.1+deb11u1 amd64 Cyrus SASL - administration programs for SASL users database ii symas-cyrus-sasl-lib 2.1.27-4bullseye1 amd64 Cyrus-SASL Libraries Any help is appreciated. Best regards Ulf

3 3

OpenLDAP on Debian 11: missing TLS ciphers?
by Jochen Keutel 03 Aug '22

03 Aug '22

Hello, we installed the standard OpenLDAP package on Debian 11. Checking the TLS ciphers offered by the server we could see that all six Camellia ciphers are gone (128 and 256, for TLS 1.0, 1.1, 1.2) compared with the standard OpenLDAP package on Debian 9. Is this special to the Debian package? Or: Has Gnutls changed something? We did run into this issue because some special devices (e.G. Cisco Prime Collaboration Assurance) cannot connect to the new OpenLDAP server. The server logfile states: TLS handshake: negotiation failure. It's not yet clear whether they really can "speak" only Camellia ... Regards Jochen.

5 7

Severe Performance Problems with dynlist on OpenLDAP 2.5+
by Bradley T Gill 02 Aug '22

02 Aug '22

We have been struggling with an upgrade of OpenLDAP 2.4.x to any version after 2.5. Our upgrade process was installing the binaries, removing our ppolicy schema and doing a slapcat of the old database and a slapadd to the new version. After doing so, response time shows a noticeable delay using an ldapsearch, the header on the response will pause long enough to read it before we get the result. This delay is causing the server to hang during heavy use and eventually crash. Through a lot of trouble shooting / trial and error, I have found that the cause is our dynlist definitions/usage. When they are removed, response time goes back to normal and there is a memory leak that stops. I can add the pertinent parts of the cn=config if needed. The question for now is has anyone else seen and hopefully resolved this issue or just know what changed for dynlist in 2.5 that might be effecting us? Thanks, Bradley Gill CISSP, CCSP

2 1

OpenLDAP 2.6 is holding connections open
by Bradley T Gill 02 Aug '22

02 Aug '22

All, I have been struggling with upgrading OpenLDAP from 2.4 to 2.5/2.6 for some time. We have finally found that we needed to rebuild the schema from scratch and re-add our customizations. The database is now running much better with one lingering problem. Our Established connections just continues to grow until we run out of resources. Below is our cn=config (minus some unrelated info). This is on the same server as where the previous version was running, so changes are openldap and openssl versions. Any insights as to what might be causing the ESTABLISHED connections to continually grow would be very appreciated. # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 422b88f4 dn: cn=config objectClass: olcGlobal cn: config olcAttributeOptions: lang- olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexHash64: FALSE olcIndexIntLen: 4 olcListenerThreads: 1 olcLocalSSF: 71 olcLogLevel: 256 olcLogFileOnly: FALSE olcMaxFilterDepth: 1000 olcReadOnly: FALSE olcSaslAuxpropsDontUseCopyIgnore: FALSE olcSaslSecProps: noplain,noanonymous olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcThreadQueues: 1 olcTLSCRLCheck: none olcTLSVerifyClient: never olcTLSProtocolMin: 0.0 olcToolThreads: 1 structuralObjectClass: olcGlobal creatorsName: cn=config createTimestamp: 20220726200129Z olcAuthzPolicy: any olcWriteTimeout: 30 olcSizeLimit: size.soft=unlimited size.hard=unlimited size.unchecked=unlimited size.pr=1000 size.prtotal=unlimited

3 5

SASL GSSAPI Channel Binding testing
by Andreas Hasenack 26 Jul '22

26 Jul '22

Hello, openldap 2.5.12 cyrus-sasl 2.1.28 + sasl channel binding patch[1] + gss-spnego maxssf=0 patch[2] openldap linked with gnutls libsasl2-modules-gssapi-mit I'm currently testing the patches[1][2] for sasl channel binding over GSSAPI + ssl/tls connection, and was wondering if I could get openldap to reject ldaps connections without sasl channel binding. Currently it seems to always accept it, but I can't be sure CB was even checked by the server by looking at logs (even with -d -1). I got windows 2016 AD to reject ldaps connections without CB over gssapi and gss-spnego, so the client part of openldap (ldapwhoami specifically) seems ok. I looked at test 077[3] and it runs the server with this configuration: dn: cn=config changetype: modify replace: olcSaslCBinding olcSaslCBinding: ${acb} Where `${acb}` loops over the 3 valid values of "none" "tls-unique" "tls-endpoint". Then a simple connection with ldapwhoami is attempted, also looping -o SASL_CBINDING=$icb over those values. I have seen the comment in that test script that it looks like tls-unique is broken when used with gnutls[4], and also a comment about MIT failing in another case[5]. When trying it manually, though, I could never get the client connection to be refused by the server. Before digging in deeper, let me just ask if my understanding is correct: - server configured with: dn: cn=config changetype: modify replace: olcSaslCBinding olcSaslCBinding: tls-endpoint - client connecting to that server over ldaps://, with GSSAPI, and with -o SASL_CBINDING=none Should that client be rejected? Sample run: $ sudo ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b cn=config '(olcSaslCBinding=*)' olcSaslCBinding SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: cn=config olcSaslCBinding: tls-endpoint $ ldapwhoami -Y GSSAPI -H ldaps://k-slapd.lxd -o SASL_CBINDING=none SASL/GSSAPI authentication started SASL username: ubuntu@VMS SASL SSF: 256 SASL data security layer installed. dn:uid=ubuntu,cn=gssapi,cn=auth And the server logs (olcLogLevel: stats): Jul 25 14:38:36 k-slapd slapd[261]: conn=1002 fd=14 ACCEPT from IP=10.0.100.36:33800 (IP=0.0.0.0:636) Jul 25 14:38:36 k-slapd slapd[261]: conn=1002 fd=14 TLS established tls_ssf=256 ssf=256 tls_proto=TLS1.3 tls_cipher=AES-256-GCM Jul 25 14:38:36 k-slapd slapd[261]: conn=1002 op=0 BIND dn="" method=163 Jul 25 14:38:36 k-slapd slapd[261]: conn=1002 op=0 RESULT tag=97 err=14 qtime=0.000011 etime=0.002447 text=SASL(0): successful result: Jul 25 14:38:36 k-slapd slapd[261]: conn=1002 op=1 BIND dn="" method=163 Jul 25 14:38:36 k-slapd slapd[261]: conn=1002 op=1 RESULT tag=97 err=14 qtime=0.000012 etime=0.000069 text=SASL(0): successful result: Jul 25 14:38:36 k-slapd slapd[261]: conn=1002 op=2 BIND dn="" method=163 Jul 25 14:38:36 k-slapd slapd[261]: conn=1002 op=2 BIND authcid="ubuntu" authzid="ubuntu" Jul 25 14:38:36 k-slapd slapd[261]: conn=1002 op=2 BIND dn="uid=ubuntu,cn=gssapi,cn=auth" mech=GSSAPI bind_ssf=256 ssf=256 Jul 25 14:38:36 k-slapd slapd[261]: conn=1002 op=2 RESULT tag=97 err=0 qtime=0.000012 etime=0.000109 text= Jul 25 14:38:36 k-slapd slapd[261]: conn=1002 op=3 EXT oid=1.3.6.1.4.1.4203.1.11.3 Jul 25 14:38:36 k-slapd slapd[261]: conn=1002 op=3 WHOAMI Jul 25 14:38:36 k-slapd slapd[261]: conn=1002 op=3 RESULT oid= err=0 qtime=0.000016 etime=0.000087 text= Jul 25 14:38:36 k-slapd slapd[261]: conn=1002 op=4 UNBIND Jul 25 14:38:36 k-slapd slapd[261]: conn=1002 fd=14 closed 1. https://github.com/cyrusimap/cyrus-sasl/commit/975edbb69070eba6b035f08776de… 2. https://github.com/cyrusimap/cyrus-sasl/pull/603/commits 3. https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_5/test… 4. https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_5/test… 5. https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_5/test…

2 3

help ldap_sasl_bind_s failed (-1)
by mohammad jamshidi 17 Jul '22

17 Jul '22

HiI have configured the openldap multimaster based on this guide: https://kifarunix.com/setup-openldap-master-master-replication-on-centos-8/ but the replication between two servers doesn't work. and I get these errors: on server1: slap_client_connect: URI=ldaps://ldapmaster02.kifarunix-demo.com DN="cn=admin,dc=ldapmaster,dc=kifarunix-demo,dc=com" ldap_sasl_bind_s failed (-1) on server 2:slap_client_connect: URI=ldaps://ldapmaster01.kifarunix-demo.com DN="cn=admin,dc=ldapmaster,dc=kifarunix-demo,dc=com" ldap_sasl_bind_s failed (-1). I didn't receive any reply from the article writer.what is wrong in the guide? Regards

1 0

Re: Pass-through
by Stéphane Veyret 15 Jul '22

15 Jul '22

> Ok, you may need to run slapd under debug mode (-1) and then try binding as > one of the users with userPassword set to the {SASL}username@realm value > to see what it's doing. Is this what I did in my first post (https://lists.openldap.org/hyperkitty/list/openldap-technical@openldap.org/…, the log is at the end of the message) or is there some missing information ? By the way, I don’t know why GMail is starting a new thread each time I answer to you… :-/

1 0

Re: Pass-through
by Stéphane Veyret 14 Jul '22

14 Jul '22

Le lun. 11 juil. 2022 à 17:22, Quanah Gibson-Mount <quanah(a)fast-mail.org> a écrit : > Do the logs from saslauthd show that LDAP is actually forwarding the > requests to it? No, I have nothing at saslauthd side, except the starting logs : # saslauthd -d -a kerberos5 saslauthd[31345] :num_procs : 5 saslauthd[31345] :mech_option: NULL saslauthd[31345] :run_path : /run/saslauthd saslauthd[31345] :auth_mech : kerberos5 saslauthd[31345] :using accept lock file: /run/saslauthd/mux.accept saslauthd[31345] :master pid is: 0 saslauthd[31345] :listening on socket: /run/saslauthd/mux saslauthd[31345] :using process model saslauthd[31345] :forked child: 31346 saslauthd[31346] :acquired accept lock saslauthd[31345] :forked child: 31347 saslauthd[31345] :forked child: 31348 saslauthd[31345] :forked child: 31349 -- Bien cordialement, / Plej kore, Stéphane Veyret

2 1

pcacheOffline cache is expired and stale instead of indefinitely cached
by Tri Tu 14 Jul '22

14 Jul '22

Hello, I understand that with the pcacheOffline TRUE and the cache contents can be use indefinitely but its cache data never get refresh with remote DSA. It's not really useful once user is login 1st time and their user attributes would not get refresh with DSA after that. But the default configuration option of pcacheOffline FALSE, pcache would use the local cached data, refresh with remote DSA and continues to response with its cached data when the DSA is cut off/unreachable. However if remote DSA is offline and the existing cached is expired, the client would get the respond with error "Proxy operation retry failed" as "cache is stale", pcache is checking with remote DSA for refresh but remote DSA is unreacheable offline. Can we continue to use the existing expired cached data (the cache contents to be used indefinitely) with pcacheOffline FALSE until remote DSA is back online (days/weeks later)? Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: conn=1115 op=0 do_bind Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: >>> dnPrettyNormal: <uid=userX,ou=employees,o=mycompany.com> Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: <<< dnPrettyNormal: <uid=userX,ou=employees,o=mycompany.com>, <uid=userX,ou=employees,o=mycompany.com> Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: conn=1115 op=0 BIND dn="uid=userX,ou=employees,o=mycompany.com" method=128 Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: do_bind: version=3 dn="uid=userX,ou=employees,o=mycompany.com" method=128 Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: => bdb_entry_get: ndn: "uid=userX,ou=employees,o=mycompany.com" Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: => bdb_entry_get: oc: "(null)", at: "(null)" Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: bdb_dn2entry("uid=userX,ou=employees,o=mycompany.com") Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: => bdb_entry_get: found entry: "uid=userX,ou=employees,o=mycompany.com" Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: bdb_entry_get: rc=0 Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: str2filter "(uid=userX)" Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: begin get_filter Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: EQUALITY Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: end get_filter 0 Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: Lock QC index = 0x562be57eb700 Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: QUERY ANSWERABLE (answered 115 times) Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: => hdb_search Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: bdb_dn2entry("uid=userX,ou=employees,o=mycompany.com") Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: => access_allowed: search access to "uid=userX,ou=employees,o=mycompany.com" "entry" requested Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: <= root access granted Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: => access_allowed: search access granted by manage(=mwrscxd) Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: base_candidates: base: "uid=userX,ou=employees,o=mycompany.com" (0x00000003) Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: => test_filter Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: EQUALITY Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: => access_allowed: search access to "uid=userX,ou=employees,o=mycompany.com" "uid" requested Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: <= root access granted Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: => access_allowed: search access granted by manage(=mwrscxd) Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: <= test_filter 6 Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: pc_bind_search: cache is stale, reftime: 1655318380, current time: 1655318385 Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: send_ldap_result: conn=1115 op=0 p=3 Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: send_ldap_result: err=0 matched="" text="" Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: =>ldap_back_getconn: conn=1115 op=0: lc=0x7f2644105d10 inserted refcnt=1 rc=0 Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: daemon: activity on 1 descriptor Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: daemon: activity on: Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: daemon: epoll: listen=7 active_threads=0 tvp=zero Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: daemon: epoll: listen=8 active_threads=0 tvp=zero Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: daemon: epoll: listen=9 active_threads=0 tvp=zero Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: daemon: epoll: listen=10 active_threads=0 tvp=zero Jun 15 18:39:45 prd-ldap1-euc1 slapd[12041]: daemon: epoll: listen=11 active_threads=0 tvp=zero Jun 15 18:39:55 prd-ldap1-euc1 slapd[12041]: conn=1115 op=0 ldap_back_retry: retrying URI="ldaps://dsa.mycompany.com" DN="" Jun 15 18:40:05 prd-ldap1-euc1 slapd[12041]: send_ldap_result: conn=1115 op=0 p=3 Jun 15 18:40:05 prd-ldap1-euc1 slapd[12041]: send_ldap_result: err=52 matched="" text="Proxy operation retry failed" Jun 15 18:40:05 prd-ldap1-euc1 slapd[12041]: send_ldap_response: msgid=1 tag=97 err=52 Jun 15 18:40:05 prd-ldap1-euc1 slapd[12041]: conn=1115 op=0 RESULT tag=97 err=52 text=Proxy operation retry failed Jun 15 18:40:06 prd-ldap1-euc1 slapd[12041]: daemon: activity on 1 descriptor Jun 15 18:40:06 prd-ldap1-euc1 slapd[12041]: daemon: activity on: Thanks

3 4

mdb_dbi_open
by Sam Dave 14 Jul '22

14 Jul '22

Hello, The docs for mdb_dbi_open mention: "This function must not be called from multiple concurrent transactions in the same process. A transaction that uses this function must finish (either commit or abort) before any other transaction in the process may use this function." Is this talking about a given environment, or does this text also hold across multiple environments? Thanks, S. Dave

2 1

TLS negotiation failure
by aRaviNd 14 Jul '22

14 Jul '22

Hi All, I am trying to debug an issue related to Chef-manage WebUI trying to authenticate users using LDAP. Authentication was working fine but after upgrading the LDAP server to the latest version of the OS we are getting authentication failures below are the errors showing in the log Jul 13 20:26:52 ldap.local slapd[18572]: connection_get(14) Jul 13 20:26:52 ldap.local slapd[18572]: connection_get(14): got connid=1003 Jul 13 20:26:52 ldap.local slapd[18572]: connection_read(14): checking for input on id=1003 Jul 13 20:26:52 ldap.local slapd[18572]: op tag 0x77, time 1657744012 Jul 13 20:26:52 ldap.local slapd[18572]: conn=1003 op=0 do_extended Jul 13 20:26:52 ldap.local slapd[18572]: conn=1003 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jul 13 20:26:52 ldap.local slapd[18572]: do_extended: oid=1.3.6.1.4.1.1466.20037 Jul 13 20:26:52 ldap.local slapd[18572]: conn=1003 op=0 STARTTLS Jul 13 20:26:52 ldap.local slapd[18572]: send_ldap_extended: err=0 oid= len=0 Jul 13 20:26:52 ldap.local slapd[18572]: send_ldap_response: msgid=0 tag=120 err=0 Jul 13 20:26:52 ldap.local slapd[18572]: conn=1003 op=0 RESULT oid= err=0 text= Jul 13 20:26:52 ldap.local slapd[18572]: daemon: activity on 1 descriptor Jul 13 20:26:52 ldap.local slapd[18572]: daemon: activity on: Jul 13 20:26:52 ldap.local slapd[18572]: Jul 13 20:26:52 ldap.local slapd[18572]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jul 13 20:26:52 ldap.local slapd[18572]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Jul 13 20:26:52 ldap.local slapd[18572]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Jul 13 20:26:52 ldap.local slapd[18572]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Jul 13 20:26:52 ldap.local slapd[18572]: daemon: epoll: listen=11 active_threads=0 tvp=NULL Jul 13 20:26:52 ldap.local slapd[18572]: daemon: activity on 1 descriptor Jul 13 20:26:52 ldap.local slapd[18572]: daemon: activity on: Jul 13 20:26:52 ldap.local slapd[18572]: 14r Jul 13 20:26:52 ldap.local slapd[18572]: Jul 13 20:26:52 ldap.local slapd[18572]: daemon: read active on 14 Jul 13 20:26:52 ldap.local slapd[18572]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jul 13 20:26:52 ldap.local slapd[18572]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Jul 13 20:26:52 ldap.local slapd[18572]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Jul 13 20:26:52 ldap.local slapd[18572]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Jul 13 20:26:52 ldap.local slapd[18572]: daemon: epoll: listen=11 active_threads=0 tvp=NULL Jul 13 20:26:52 ldap.local slapd[18572]: connection_get(14) Jul 13 20:26:52 ldap.local slapd[18572]: connection_get(14): got connid=1003 Jul 13 20:26:52 ldap.local slapd[18572]: connection_read(14): checking for input on id=1003 Jul 13 20:26:52 ldap.local slapd[18572]: connection_read(14): TLS accept failure error=-1 id=1003, closing Jul 13 20:26:52 ldap.local slapd[18572]: connection_closing: readying conn=1003 sd=14 for close Jul 13 20:26:52 ldap.local slapd[18572]: connection_close: conn=1003 sd=14 Jul 13 20:26:52 ldap.local slapd[18572]: =>ldap_back_conn_destroy: fetching conn 1003 Jul 13 20:26:52 ldap.local slapd[18572]: daemon: removing 14 Jul 13 20:26:52 ldap.local slapd[18572]: conn=1003 fd=14 closed (TLS negotiation failure) Jul 13 20:26:52 ldap.local slapd[18572]: daemon: activity on 1 descriptor Jul 13 20:26:52 ldap.local slapd[18572]: daemon: activity on:: We are not seeing the error while connecting to OpenLDAP servers using OpenSSL or LDAP client tools. How can we debug further to see why the server was not able to complete TLS negotiation? Package versions are openldap-2.4.44-25.el7_9.x86_64 openssl-1.0.2k-25.el7_9.x86_64 kernel-3.10.0-1160.66.1.el7.x86_64 Regards, Aravind M D

2 1

When pwdReset is set to TRUE
by Francesco Malvezzi 13 Jul '22

13 Jul '22

hi all, the pwdReset attribute is set to TRUE on password reset unless entry's pwdPolicySubentry's pwdMustChange is FALSE or missing? Does the default policy's pwdMustChange play a role (even on entries with valid pwdPolicySubentry)? thank you, Francesco

1 0

How to relay read and write requests to different ldap servers
by nagamani.chinnapaiyan＠viasat.com 13 Jul '22

13 Jul '22

Hi, I am new to ldap. We have 4 ldap servers, 2 of them are in mirror-mode providers, 2 of them are just consumers/replicas. I am working on loadbalancer for these 4 ldap servers using ldap/meta backend. I want to the ldap proxy/loadbalancer to, redirect write requests to one of the 2 mirror-mode providers. redirect read requests to any of the 2 replicas/consumers. I know ldap backend has uri list which can be used to redirect to mirror-mode providers. But I want to redirect only the write requests. Regards, Nagamani Chinnapaiyan

5 8

pwdChangedTime range query
by Francesco Malvezzi 13 Jul '22

13 Jul '22

hi all, I am using some pwdChangedTime range queries to warn users about password expiration. An example filter might be: (&(pwdChangedTime<=20211019000000Z)(pwdChangedTime>=20211018000001Z)(pwdPolicySubentry=cn=default270g,ou=policies,ou=people,dc=example,dc=edu)) since in-place upgrade to OpenLDAP-2.6.2 these queries return no entries. If I remove either comparison condition: (&(pwdChangedTime>=20211018000001Z)(pwdPolicySubentry=cn=default270g,ou=policies,ou=people,dc=example,dc=edu)) (&(pwdChangedTime<=20211019000000Z)(pwdPolicySubentry=cn=default270g,ou=policies,ou=people,dc=example,dc=edu)) they both work. Did I forget some re-index? thank you in advance for your time, Francesco

4 6

RE26 testing call #2 (OpenLDAP 2.6.3)
by Quanah Gibson-Mount 11 Jul '22

11 Jul '22

This is the second testing call for OpenLDAP 2.6.3. Depending on the results, this may be the only testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.6.3 Engineering Fixed librewrite declaration of calloc (ITS#9841) Fixed libldap to check for NULL ld (ITS#9157) Fixed libldap memory leaks (ITS#9876) Fixed lloadd to correctly tag Notice of Disconnection (ITS#9856) Fixed slapd kqueue support (ITS#9847) Fixed slapd delta-sync DN leak on ADD ops (ITS#9866) Fixed slapd replication with back-glue (ITS#9868) Fixed slapd lastbind replication with chaining (ITS#9863) Fixed slapd-ldap to correctly set authzid (ITS#9863) Fixed slapd-mdb to check for stale readers on MDB_READERS_FULL (ITS#7165) Fixed slapd-mdb indexer task with replicated config (ITS#9858) Fixed slapo-accesslog onetime memory leak (ITS#9864) Fixed slapo-ppolicy interaction with slapo-rwm (ITS#9871) Fixed slapo-rwm to handle escaping special characters (ITS#9817) Fixed slapo-syncprov memory leaks (ITS#9867) Fixed slapo-syncprov fallback in delta-sync mode (ITS#9823) Fixed slapo-unique to not release NULL entry (ITS#8245) Build Environment Added slapd-watcher -c contextDN option (ITS#9865) Fixed parallel builds (ITS#9840) Fixed test020 to skip back-wt (ITS#9859) Fixed slapd-watcher SID handling with single URI (ITS#9850) Fixed test043 with workaround for ITS#9878 Contrib Added slapo-emptyds contrib module (ITS#8882) Added slapo-ciboolean contrib module (ITS#9855) Fixed slapo-autogroup backwards compat (ITS#9020) Update ppm module to the 2.2 release (ITS#9846) Documentation Fixed ldap_get_option(3) to clarify ldap_get/set_option restrictions (ITS#9824) Fixed slapd-ldap(5),slapd-meta(5) missing bold tag on authz parameter (ITS#9872) Regards, Quanah

2 1

RE25 testing call #2 (OpenLDAP 2.5.13)
by Quanah Gibson-Mount 11 Jul '22

11 Jul '22

This is the second testing call for OpenLDAP 2.5.13. Depending on the results, this may be the only testing call. Generally, get the code for RE25: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_5/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.5.13 Engineering Fixed librewrite declaration of calloc (ITS#9841) Fixed libldap memory leaks (ITS#9876) Fixed slapd kqueue support (ITS#9847) Fixed slapd delta-sync DN leak on ADD ops (ITS#9866) Fixed slapd replication with back-glue (ITS#9868) Fixed slapd-mdb to check for stale readers on MDB_READERS_FULL (ITS#7165) Fixed slapo-accesslog onetime memory leak (ITS#9864) Fixed slapo-ppolicy interaction with slapo-rwm (ITS#9871) Fixed slapo-syncprov memory leaks (ITS#9867) Fixed slapo-syncprov fallback in delta-sync mode (ITS#9823) Fixed slapo-unique to not release NULL entry (ITS#8245) Build Environment Added slapd-watcher -c contextDN option (ITS#9865) Fixed parallel builds (ITS#9840) Fixed test020 to skip back-wt (ITS#9859) Fixed slapd-watcher SID handling with single URI (ITS#9850) Fixed test043 with workaround for ITS#9878 Contrib Added slapo-emptyds contrib module (ITS#8882) Fixed slapo-autogroup backwards compat (ITS#9020) Documentation Fixed ldap_get_option(3) to clarify ldap_get/set_option restrictions (ITS#9824) Fixed slapd-ldap(5),slapd-meta(5) missing bold tag on authz parameter (ITS#9872) Thanks! Regards, Quanah

2 1

Re: Pass-through
by Stéphane Veyret 11 Jul '22

11 Jul '22

Hello Quanah, Thank you for your answer (and sorry for double-reply, I forgot to answer to all at first time). > The way that SASL passthrough works is that you put the value {SASL} for > the userPassword. This tells slapd to pass the user authentication to SASL > to handle. You don't set an actual password value in the userPassword > attribute. Actually, I did not set a real password, only, as I saw in examples : userPassword: {SASL}user@realm (you don’t directly see it in the extracts I provided because the password there is base64 encoded). I tried setting only, as you suggested : userPassword: {SASL} but I don’t have any better result. Regards, Stéphane

2 1

dirSync syncrepl_dirsync_message: unknown attributeType member;range=1-1
by Christopher Paul 10 Jul '22

10 Jul '22

Hello OpenLDAP-Technical, I am testing the dirSync replication. I am trying to replicate Active Directory (Windows Server 2019) -> OpenLDAP 2.5.12 from symas-openldap-servers-2.5.12-1.el8.x86_64 RPM on RedHat 8.6. Group members are not replicating, and I am seeing this error: syncrepl_dirsync_message: rid=999 unknown attributeType member;range=1-1 In this case, "member" is a recognized attribute per "core.schema" and is not a problem unless sent with the range indicator, which seems not to be part of the protocol but rather be an AD "embellishment". Those responsible for AD call this "Searching Using Range Retrieval" if you care to look it up. I guess has this default now of 1500 max values for an LDAP response, and it will indicate that the attribute has greater than this number of values by sending "member;range=0-1499" instead of "member" as the attribute type in the result data if there are more than 1500 values, and subsequently, if the amount is greater than 3000, "member;range=1500-2999", etc. I also observed (using packet capture) that when using the dirSync control, all groups are sent with this range notation, even if below the limit, even if just one member, Windows Server 2019 AD DS sends a PartialAttributeList of type "member;range=1-1". Although using ldapsearch without the control only will send the range notation if the number of member values is greater than the 1500 limit. So I am wondering if anyone else has seen this? Am I doing something wrong or is this a bug? What version of Windows was the dirSync syncrepl functionality developed to work with and/or tested with? I can provide more info as needed as this issue is just testing right now in my local lab. Thanks, Chris Paul | Rex Consulting | https://www.rexconsulting.net

2 2

Pass-through
by Stéphane Veyret 09 Jul '22

09 Jul '22

Hi, In my home network, I have a MIT Kerberos installation backed by OpenLDAP. Because some of my apps do not work using GSSAPI, I would like to be able to log into them directly using LDAP. So I tried to set-up Pass-through, but with no success. Here is what I did: * compiled OpenLDAP with --enable-spasswd (actually, it’s a Gentoo installation with use flag sasl), * setup Cyrus SASL to use Kerberos, * configured /usr/lib64/susl2/slapd.conf to use saslauth, * configured OpenLDAP with SASL host and secprops., * updated my user to have “userPassword:: e1NBU0x9c3RlcGhhbmVASE9NRS5MQU4=”, * restarted. SASL seems to be working correctly: > testsaslauthd -u stephane -p mypassword 0: OK "Success." But not LDAP : > ldapwhoami -x -D "uid=stephane,ou=user,dc=home,dc=lan" -Z -W Enter LDAP Password: ldap_bind: Invalid credentials (49) It seems to even not try to contact Cyrus SASL… I searched for hours accross the Internet but could not find any clue. So if someone here could help me, I would really appreciate. My LDAP config: # config dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /run/openldap/slapd.args olcLocalSSF: 256 olcLogLevel: stats olcPidFile: /run/openldap/slapd.pid olcSaslHost: localhost olcSaslSecProps: none > cat /usr/lib64/sasl2/slapd.conf pwcheck_method: saslauthd mech_list: plain saslauthd_path: /var/run/saslauthd/mux Here is an extract of the log I could get while attempting to bind: TLS trace: SSL_accept:SSLv3/TLS write session ticket 62af4376 connection_read(17): unable to get TLS client DN, error=49 id=1012 62af4376 conn=1012 fd=17 TLS established tls_ssf=256 ssf=256 62af4376 daemon: activity on 1 descriptor 62af4376 daemon: activity on: 62af4376 daemon: epoll: listen=7 active_threads=0 tvp=NULL 62af4376 daemon: epoll: listen=8 active_threads=0 tvp=NULL 62af4376 daemon: epoll: listen=9 active_threads=0 tvp=NULL 62af437b daemon: activity on 1 descriptor 62af437b daemon: activity on: 17r 62af437b daemon: read active on 17 62af437b daemon: epoll: listen=7 active_threads=0 tvp=NULL 62af437b daemon: epoll: listen=8 active_threads=0 tvp=NULL 62af437b daemon: epoll: listen=9 active_threads=0 tvp=NULL 62af437b connection_get(17) 62af437b connection_get(17): got connid=1012 62af437b connection_read(17): checking for input on id=1012 ber_get_next tls_read: want=5, got=5 tls_read: want=97, got=97 ldap_read: want=8, got=8 ldap_read: want=72, got=72 ber_get_next: tag 0x30 len 78 contents: ber_dump: buf=0x7f6df81074e0 ptr=0x7f6df81074e0 end=0x7f6df810752e len=78 62af437b op tag 0x60, time 1655653243 ber_get_next tls_read: want=5 error=Resource temporarily unavailable ldap_read: want=8 error=Resource temporarily unavailable 62af437b conn=1012 op=1 do_bind 62af437b daemon: activity on 1 descriptor 62af437b daemon: activity on: ber_scanf fmt ({imt) ber: 62af437b daemon: epoll: listen=7 active_threads=0 tvp=NULL 62af437b daemon: epoll: listen=8 active_threads=0 tvp=NULL ber_dump: buf=0x7f6df81074e0 ptr=0x7f6df81074e3 end=0x7f6df810752e len=75 ber_scanf fmt (m}) ber: ber_dump: buf=0x7f6df81074e0 ptr=0x7f6df810751a end=0x7f6df810752e len=20 62af437b daemon: epoll: listen=9 active_threads=0 tvp=NULL 62af437b >>> dnPrettyNormal: <uid=stephane,ou=user,dc=home,dc=lan> => ldap_bv2dn(uid=stephane,ou=user,dc=home,dc=lan,0) <= ldap_bv2dn(uid=stephane,ou=user,dc=home,dc=lan)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=stephane,ou=user,dc=home,dc=lan)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=stephane,ou=user,dc=home,dc=lan)=0 62af437b <<< dnPrettyNormal: <uid=stephane,ou=user,dc=home,dc=lan>, <uid=stephane,ou=user,dc=home,dc=lan> 62af437b conn=1012 op=1 BIND dn="uid=stephane,ou=user,dc=home,dc=lan" method=128 62af437b do_bind: version=3 dn="uid=stephane,ou=user,dc=home,dc=lan" method=128 62af437b ==> mdb_bind: dn: uid=stephane,ou=user,dc=home,dc=lan 62af437b mdb_dn2entry("uid=stephane,ou=user,dc=home,dc=lan") 62af437b => mdb_dn2id("uid=stephane,ou=user,dc=home,dc=lan") 62af437b <= mdb_dn2id: got id=0xb 62af437b => mdb_entry_decode: 62af437b <= mdb_entry_decode 62af437b => access_allowed: result not in cache (userPassword) 62af437b => access_allowed: auth access to "uid=stephane,ou=user,dc=home,dc=lan" "userPassword" requested 62af437b => acl_get: [1] attr userPassword 62af437b => acl_mask: access to entry "uid=stephane,ou=user,dc=home,dc=lan", attr "userPassword" requested 62af437b => acl_mask: to value by "", (=0) 62af437b <= check a_dn_pat: cn=kerberos,ou=service,dc=home,dc=lan 62af437b <= check a_dn_pat: self 62af437b <= check a_dn_pat: anonymous 62af437b <= acl_mask: [3] applying auth(=xd) (stop) 62af437b <= acl_mask: [3] mask: auth(=xd) 62af437b => slap_access_allowed: auth access granted by auth(=xd) 62af437b => access_allowed: auth access granted by auth(=xd) 62af437b SASL Canonicalize [conn=1012]: authcid="stephane(a)HOME.LAN" 62af437b SASL Canonicalize [conn=1012]: authcid="stephane(a)HOME.LAN" 62af437b send_ldap_result: conn=1012 op=1 p=3 62af437b send_ldap_result: err=49 matched="" text="" 62af437b send_ldap_response: msgid=2 tag=97 err=49 ber_flush2: 14 bytes to sd 17 tls_write: want=36, written=36 ldap_write: want=14, written=14 62af437b conn=1012 op=1 RESULT tag=97 err=49 text= 62af437b daemon: activity on 1 descriptor 62af437b daemon: activity on: 17r 62af437b daemon: read active on 17 62af437b daemon: epoll: listen=7 active_threads=0 tvp=NULL 62af437b daemon: epoll: listen=8 active_threads=0 tvp=NULL 62af437b daemon: epoll: listen=9 active_threads=0 tvp=NULL 62af437b connection_get(17) 62af437b connection_get(17): got connid=1012 62af437b connection_read(17): checking for input on id=1012 ber_get_next tls_read: want=5, got=5 tls_read: want=24, got=24 ldap_read: want=8, got=7 ber_get_next: tag 0x30 len 5 contents: ber_dump: buf=0x7f6e081065d0 ptr=0x7f6e081065d0 end=0x7f6e081065d5 len=5 62af437b op tag 0x42, time 1655653243 ber_get_next tls_read: want=5, got=5 tls_read: want=19, got=19 TLS trace: SSL3 alert read:warning:close notify ldap_read: want=8, got=0 62af437b ber_get_next on fd 17 failed errno=0 (Success) 62af437b connection_read(17): input error=-2 id=1012, closing. 62af437b connection_closing: readying conn=1012 sd=17 for close 62af437b connection_close: deferring conn=1012 sd=17 62af437b conn=1012 op=2 do_unbind 62af437b conn=1012 op=2 UNBIND 62af437b connection_resched: attempting closing conn=1012 sd=17 62af437b connection_close: conn=1012 sd=17 62af437b daemon: removing 17 tls_write: want=24, written=24 TLS trace: SSL3 alert write:warning:close notify 62af437b conn=1012 fd=17 closed 62af437b daemon: activity on 1 descriptor 62af437b daemon: activity on: 62af437b daemon: epoll: listen=7 active_threads=0 tvp=NULL 62af437b daemon: epoll: listen=8 active_threads=0 tvp=NULL 62af437b daemon: epoll: listen=9 active_threads=0 tvp=NULL -- Bien cordialement, / Plej kore, Stéphane Veyret

2 1

RE26 testing call #1 (OpenLDAP 2.6.3)
by Quanah Gibson-Mount 08 Jul '22

08 Jul '22

This is the first testing call for OpenLDAP 2.6.3. Depending on the results, this may be the only testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.6.3 Engineering Fixed librewrite declaration of calloc (ITS#9841) Fixed libldap to check for NULL ld (ITS#9157) Fixed libldap memory leaks (ITS#9876) Fixed lloadd to correctly tag Notice of Disconnection (ITS#9856) Fixed slapd kqueue support (ITS#9847) Fixed slapd delta-sync DN leak on ADD ops (ITS#9866) Fixed slapd replication with back-glue (ITS#9868) Fixed slapd lastbind replication with chaining (ITS#9863) Fixed slapd-ldap to correctly set authzid (ITS#9863) Fixed slapd-mdb to check for stale readers on MDB_READERS_FULL (ITS#7165) Fixed slapd-mdb indexer task with replicated config (ITS#9858) Fixed slapo-accesslog onetime memory leak (ITS#9864) Fixed slapo-ppolicy interaction with slapo-rwm (ITS#9871) Fixed slapo-rwm to handle escaping special characters (ITS#9817) Fixed slapo-syncprov memory leaks (ITS#9867) Fixed slapo-syncprov fallback in delta-sync mode (ITS#9823) Fixed slapo-unique to not release NULL entry (ITS#8245) Build Environment Added slapd-watcher -c contextDN option (ITS#9865) Fixed parallel builds (ITS#9840) Fixed test020 to skip back-wt (ITS#9859) Fixed slapd-watcher SID handling with single URI (ITS#9850) Fixed test043 with workaround for ITS#9878 Contrib Added slapo-emptyds contrib module (ITS#8882) Added slapo-ciboolean contrib module (ITS#9855) Fixed slapo-autogroup backwards compat (ITS#9020) Update ppm module to the 2.2 release (ITS#9846) Documentation Fixed ldap_get_option(3) to clarify ldap_get/set_option restrictions (ITS#9824) Fixed slapd-ldap(5),slapd-meta(5) missing bold tag on authz parameter (ITS#9872)

3 4

RE25 testing call #1 (OpenLDAP 2.5.13)
by Quanah Gibson-Mount 08 Jul '22

08 Jul '22

This is the first testing call for OpenLDAP 2.5.13. Depending on the results, this may be the only testing call. Generally, get the code for RE25: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_5/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.5.13 Engineering Fixed librewrite declaration of calloc (ITS#9841) Fixed libldap memory leaks (ITS#9876) Fixed slapd kqueue support (ITS#9847) Fixed slapd delta-sync DN leak on ADD ops (ITS#9866) Fixed slapd replication with back-glue (ITS#9868) Fixed slapd-mdb to check for stale readers on MDB_READERS_FULL (ITS#7165) Fixed slapo-accesslog onetime memory leak (ITS#9864) Fixed slapo-ppolicy interaction with slapo-rwm (ITS#9871) Fixed slapo-syncprov memory leaks (ITS#9867) Fixed slapo-syncprov fallback in delta-sync mode (ITS#9823) Fixed slapo-unique to not release NULL entry (ITS#8245) Build Environment Added slapd-watcher -c contextDN option (ITS#9865) Fixed parallel builds (ITS#9840) Fixed test020 to skip back-wt (ITS#9859) Fixed slapd-watcher SID handling with single URI (ITS#9850) Fixed test043 with workaround for ITS#9878 Contrib Added slapo-emptyds contrib module (ITS#8882) Fixed slapo-autogroup backwards compat (ITS#9020) Documentation Fixed ldap_get_option(3) to clarify ldap_get/set_option restrictions (ITS#9824) Fixed slapd-ldap(5),slapd-meta(5) missing bold tag on authz parameter (ITS#9872) Regards, Quanah

3 3

Re: dynlist overlay, memberURL not working on spcified attribiutes
by Bog Dan 07 Jul '22

07 Jul '22

Thanks for your reply, I try to explain. Populating memberOf attribiute to users entry working well using this: *olcDynListAttrSet: {1}inetOrgPerson labeledURI memberOf* User entry look as follow: *dn: uid=test1,ou=people,dc=test,dc=comsambaAcctFlags: [U ]sambaPwdLastSet: 9999999999sambaNTPassword: passo: testsambaSID: S-1-5-21-3945181060-1826002392-430723570pwdPolicySubentry: cn=noexpire,ou=ppolicy,dc=test,dc=comcreateTimestamp: 20220529070624.324Zdescription: User accountuserPassword:: passsambaPwdCanChange: 1528009736sambaPwdMustChange: 0mail: test1(a)test.com <test1(a)test.com>loginShell: /bin/bashgivenName: Test1sambaLogonTime: 0sn: Testcn: Test1 TestobjectClass: posixAccountobjectClass: topobjectClass: inetOrgPersonobjectClass: personobjectClass: organizationalPersonobjectClass: sambaSamAccountobjectClass: shadowAccounthomeDirectory: /home/test1pwdChangedTime: 20220529070856.504ZgidNumber: 1002uidNumber: 1002uid: test1structuralObjectClass: inetOrgPersonentryUUID: 348cd83e-7c6a-103c-8612-1918ce7a0bc4creatorsName: cn=admin,dc=test,dc=comlabeledURI: ldap:///ou=groups,dc=test,dc=com??sub?(|(&(objectclass=groupOfUniqueNames)(uniqueMember=uid=test1,ou=people,dc=test,dc=com))(&(objectClass=posixGroup)(memberUid=test1)))entryCSN: 20220609180738.487916Z#000000#001#000000modifiersName: cn=admin,dc=test,dc=commodifyTimestamp: 20220609180738ZmemberOf: cn=devops,ou=groups,dc=test,dc=comentryDN: uid=test1,ou=people,dc=test,dc=comsubschemaSubentry: cn=SubschemahasSubordinates: FALSE* Static group entry: *cn=devops,ou=groups,dc=test,dc=comcn: devopsobjectClass: groupOfUniqueNamesobjectClass: topdescription: devops groupuniqueMember: uid=test1,ou=people,dc=test,dc=comuniqueMember: uid=test2,ou=people,dc=test,dc=com* Next what I want to do is agregate multiple groups to one virtual using this: *olcDynListAttrSet: {0}groupOfURLs memberURL member* Then I create appropiate group: *cn=testluri,ou=groups,dc=test,dc=comcn: testluriobjectClass: topobjectClass: groupOfURLsdescription: test groupmemberURL: ldap:///ou=people,dc=test,dc=com??sub?(memberOf=cn=devops,ou=groups,dc=test,dc=com)* but this don't add memeber entry to this group. When I changing memberURL as follow: *memberURL: ldap:///ou=people,dc=test,dc=com??sub?(|(uid=test1)(uid=test2))* member attribute was added to testluri group: *cn=testluri,ou=groups,dc=test,dc=comcn: testluriobjectClass: topobjectClass: groupOfURLsdescription: test groupmemberURL: ldap:///ou=people,dc=test,dc=com??sub?(memberOf=cn=devops,ou=groups,dc=test,dc=com)* *member: uid=test1,ou=people,dc=test,dc=com* *member: uid=test2,ou=people,dc=test,dc=com* but this is not the goal. As I mentioned I want to agregate multiple group to one using memberOf attribute in memberURL: *memberURL: ldap:///ou=people,dc=test,dc=com??sub?(memberOf=cn=devops,ou=groups,dc=test,dc=com)* but this not working. What I'm doing wrong? Reagrds BS śr., 29 cze 2022 o 19:17 Quanah Gibson-Mount <quanah(a)fast-mail.org> napisał(a): > > > --On Tuesday, June 28, 2022 12:18 PM +0200 Bog Dan <bsiara.cgi(a)gmail.com> > wrote: > > > > > Hi All, > > I have problem with dynlist overlay, this is my configuration: > > > > > > > > olcOverlay={1}dynlist,olcDatabase={1}mdb,cn=config > > objectClass: olcOverlayConfig > > objectClass: olcDynListConfig > > olcOverlay: {1}dynlist > > olcDynListAttrSet: {0}groupOfURLs memberURL member > > olcDynListAttrSet: {1}inetOrgPerson labeledURI memberOf > > > > > > > > First I create static group: > > > > > > cn=devops,ou=groups,dc=test,dc=com > > cn: devops > > objectClass: groupOfUniqueNames > > objectClass: top > > description: devops group > > uniqueMember: uid=test1,ou=people,dc=test,dc=com > > uniqueMember: uid=test2,ou=people,dc=test,dc=com > > > > > > > > When I create new dynamic group: > > > > cn=testluri,ou=groups,dc=test,dc=com > > cn: testluri > > objectClass: top > > objectClass: groupOfURLs > > description: test group > > memberURL: > > ldap:///ou=people,dc=test,dc=com??sub?(memberOf=cn=devops,ou=groups,dc=te > > st,dc=com) > > > > > > > > I don't get any member of group. Users test1 and test2 already have > > memberOf attribute: > > > > memberOf: cn=devops,ou=groups,dc=test,dc=com > > > > > > > > When I change memberURL to use not dynamic attributes (memberOf): > > > > > > memberURL: > ldap:///ou=people,dc=test,dc=com??sub?(|(uid=test1)(uid=test2)) > > > > > > > > users added to testluri group and dynlist works well. > > What I should do to configure dynlist with memberOf? > > I've read your email multiple times, and quite frankly I don't understand > what your end goal is. > > If your end goal is to have static groups, where memberOf is dynamically > populated on the user entries (which is the usual use case for replacing > the 2.4 memberOf), then your configs are clearly incorrect. > > Can you better explain what your end goal is? > > Thanks, > Quanah > > > >

2 1

dynlist overlay, memberURL not working on spcified attribiutes
by Bog Dan 29 Jun '22

29 Jun '22

Hi All, I have problem with dynlist overlay, this is my configuration: olcOverlay={1}dynlist,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcDynListConfig olcOverlay: {1}dynlist olcDynListAttrSet: {0}groupOfURLs memberURL member olcDynListAttrSet: {1}inetOrgPerson labeledURI memberOf First I create static group: cn=devops,ou=groups,dc=test,dc=com cn: devops objectClass: groupOfUniqueNames objectClass: top description: devops group uniqueMember: uid=test1,ou=people,dc=test,dc=com uniqueMember: uid=test2,ou=people,dc=test,dc=com When I create new dynamic group: cn=testluri,ou=groups,dc=test,dc=com cn: testluri objectClass: top objectClass: groupOfURLs description: test group memberURL: ldap:///ou=people,dc=test,dc=com??sub?(memberOf=cn=devops,ou=groups,dc=test,dc=com) I don't get any member of group. Users test1 and test2 already have memberOf attribute: memberOf: cn=devops,ou=groups,dc=test,dc=com When I change memberURL to use not dynamic attributes (memberOf): memberURL: ldap:///ou=people,dc=test,dc=com??sub?(|(uid=test1)(uid=test2)) users added to testluri group and dynlist works well. What I should do to configure dynlist with memberOf? Openldap 2.5.12 Regards BS

2 1

Filter string with escaped forward slash
by Jeffrey Walton 29 Jun '22

29 Jun '22

Hi Everyone, Microsoft AD requires a forward slash ('/') be escaped with "\\2f". Confer, [1, 2]. However, escaping the forward slash is not required per the RFCs (if I am parsing the RFCs correctly). I would like to know if OpenLDAP recognizes an escaped forward slash and handles it properly. I suspect OpenLDAP does since slapd is just a front-end to different directories. The reason I would like to know is for a generic encoder. If MS Active Directory, Novell eDirectory and OpenLDAP handle the escaped forward slash as expected, then it makes it easier to write the encoder. Thanks in advance, Jeff [1] https://social.technet.microsoft.com/wiki/contents/articles/5312.active-dir… [2] https://docs.microsoft.com/en-us/windows/win32/adsi/ldap-dialect

3 2

role manage can bypass pwdCheckQuality with MOD but not with ADD op
by tempo＠net-c.com 28 Jun '22

28 Jun '22

Hi, I'm doing some testing on userPassword management actually with openldap 2.5.9 I noticed that I could MOD a userPassword without checking quality if my admin role was "manage" However, if I try to ADD a user with its attribute userPassword set, then quality is checked although the role "manage" ppolicy in both cases are the default one (policy subentry not set) Is it normal behavior ? Regards,

3 5

setting slapd logging to STDOUT only
by Alceu Rodrigues de Freitas Junior 27 Jun '22

27 Jun '22

Greetings, My name is Alceu and I'm new to this list. I'm experimenting with OpenLDAP at a Google Cloud, running it as a Pod inside a GKE cluster. I've being struggling to setup slapd to send it's logs to STDOUT only, but it seems in most cases the logs are sent to STDERR. The problem is, for GCP Log Explorer, everything that is sent to STDERR is considered an error, even when it's not. :-) Here is a reference: https://stackoverflow.com/questions/71158475/gcp-log-explorer-shows-wrong-s…. I'm using this open source project <https://github.com/osixia/docker-openldap> to deploy OpenLDAP as a Docker container, but there is no configuration option for that. I would like to make it clear that this project is not using the latest OpenLDAP stable version. AFAIK, slapd will use syslog facility for logging and will write to the terminal if the "-d" option is in use, which in fact it is: $ docker exec -ti openldap /bin/bash root@56529dea5931:/# ps aux USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.7 0.2 76528 47232 ? Ss 20:54 0:00 /usr/bin/python -u /container/tool/run --loglevel debug openldap 21 0.1 0.0 294932 14844 ? Sl 20:54 0:00 /usr/sbin/slapd -h ldap://56529dea5931 ldaps://56529dea5931 ldapi:/// -u openldap -g openldap -d 256 root 25 1.0 0.0 19868 3600 pts/0 Ss 20:54 0:00 /bin/bash root 32 0.0 0.0 38312 3364 pts/0 R+ 20:54 0:00 ps aux Is there any way to configure slapd to use STDOUT for everything, besides using shell redirection (2>&1)? Thanks in advance, Alceu

1 0

Setting to suppress "connection_read(XXX): no connection!"
by Uwe Sauter 24 Jun '22

24 Jun '22

Dear list, is there a way to configure slapd to not emit messages regarding "connection_read(XXX): no connection!"? Currently the configuration contails "loglevel none" but these messages are sent to syslog local4.debug regardless. In case the version is relevant, this is 2.4.59 on RHEL 8.4. slapd is started with URL list "ldap:/// ldaps:/// ldapi:///" Thanks, Uwe

1 0

rwm bindDN context and ppolicy issues
by Kartik Subbarao 24 Jun '22

24 Jun '22

I'm able to specify rwm bindDN rules without password-policy enabled just fine, like this one: rwm-rewriteContext bindDN rwm-rewriteRule "^([^=]+)=([^@]+)@olddomain.com(.+),dc=olddomain,dc=com$" "$1=$2(a)newdomain.com$3,dc=newdomain,dc=com" ":@" However, when I enable password policy (which also works fine on its own), slapd segfaults. From doing a backtrace and stepping through the code, it looks like the crux of the issue is that the mdb_info struct ends up with garbage data: struct mdb_info *mdb = (struct mdb_info *) op->o_bd->be_private; mi_dbenv_home and mi_monitor have random stuff in them. I'm mulling over how much additional time to spend on this. rwm is a very elegant solution to a current issue that could save me a bunch of time to set up additional LDAP servers with the renamed data. If this is an isolated bug for which a quick fix might be possible, I might investigate further. But if it's a thorny issue or just the tip of the iceberg of things where rwm might break unexpectedly, then it may be better for me to consider other options. OpenLDAP developers, what do your instincts say on this? Regards, -Kartik

2 3

Re: LDAP over TLS not doing hostname verification in version 2.4.59
by radiatejava 23 Jun '22

23 Jun '22

Anyone of these issues could be responsible? Just checking OpenLDAP 2.4.46 Release (2018/03/22) Fixed libldap connection delete callbacks when TLS fails to start (ITS#8717) Fixed libldap to not reuse tls_session if TLS hostname check fails (ITS#7373) Thanks On Wed, Jun 22, 2022 at 7:51 AM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > --On Tuesday, June 21, 2022 11:29 PM -0700 radiatejava > <radiatejava(a)gmail.com> wrote: > > > I raised the issue https://bugs.openldap.org/show_bug.cgi?id=9869 but > > it has been set to verified/invalid state now. However, I do not know > > which version addresses the issue. Can anyone tell me which version > > would still verify the hostname when doing LDAP over TLS. > > The OpenLDAP 2.4 series is historic, no bug reports for it will be > considered. > > No changes have been made to OpenLDAP 2.4 series to disable hostname > verification by the OpenLDAP project. If you are using libraries provided > by downstream distributions, they may have made unauthorized changes to how > libldap functions in regards to TLS. Additionally, if you were using an > OpenSSL linked libldap and are now using a GnuTLS linked libldap, then some > behaviors are different as documented in the man pages. > > Generally I'd advise starting with a supported version of OpenLDAP. > > Regards, > Quanah > > > >

2 1

LDAP over TLS not doing hostname verification in version 2.4.59
by radiatejava 22 Jun '22

22 Jun '22

My software was using openldap client 2.4.44 to talk to the LDAP server. We have shifted to 2.4.59 now to address some issues. Ever since we shifted, the new version is allowing LDAP over TLS without hostname verification. In the older ver 2.4.44, I always got this error if hostname did not match the CN value: return code -1 - Can't contact LDAP server) diagnostic message TLS: hostname does not match CN in peer certificate But after the lib update, no such error even if I am using LDAP server IP to do LDAP bind while LDAP server certificate has CN set as some FQDN (say test.ldap.com). Our client side code has not changed while we updated the ldap lib. For our client, we are only doing these settings: ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTDIR, lCertsDir) ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTFILE, lCert) Has there been any change in this regard? How do I enforce hostname verification now? I raised the issue https://bugs.openldap.org/show_bug.cgi?id=9869 but it has been set to verified/invalid state now. However, I do not know which version addresses the issue. Can anyone tell me which version would still verify the hostname when doing LDAP over TLS. Thanks.

2 1

OpenLDAP in Ubuntu Jammy (LTS)
by Sergio Durigan Junior 22 Jun '22

22 Jun '22

Hi there, I would like to inform the OpenLDAP community that, after a few months sorting out the details, the OpenLDAP package of the Ubuntu Jammy (LTS) release will now receive updates every time there's a new patch version released for the 2.5.x upstream series. In fact, if you are using Ubuntu Jammy you can start benefiting from this new policy right away: OpenLDAP 2.5.12 has just been accepted into the jammy-updates repository and should be available soon. I'd like to thank the community for changing your release process recently and electing 2.5.x as your LTS release; this really helped me making the case to obtain a Micro Release Exception from the Ubuntu SRU team :-). If I may, I would also like to make a small request here. It would be very helpful if the OpenLDAP website could also offer the "Release Documents" section (from https://openldap.org/software/) for OpenLDAP 2.5.x as well. Actually, it would also be great if the "Announcement" page could stay available "forever", and be made per-release (instead of having just one "announce.html" page that gets overwritten every time there's a new release). I don't know much about web stuff in general, but I can help with this if needed. Thank you very much, and I hope this email brings news to the Ubuntu OpenLDAP users out there. Cheers, -- Sergio GPG key ID: E92F D0B3 6B14 F1F4 D8E0 EB2F 106D A1C8 C3CB BF14

2 2

Upgrade config from 2.4.49 to 2.5.11 is failing.
by farooq.fortinet＠gmail.com 21 Jun '22

21 Jun '22

Current Openldap 2.4.49 is working fine with syncprov configuration. Planing to upgrade to recent versions. Took backup of system using slapcat. Upgraded the dev server to 2.5.11. Now when trying to import config using slapadd. It is failing with following error. overlay_config(): overlay "syncprov" already in list slapadd: could not add entry dn="olcOverlay={1}syncprov,olcDatabase={0}config,cn=config" (line=1900): slapadd shutdown: initiated slapadd destroy: freeing system resources. syncinfo_free: rid=100 Any help or tip? Thanks Farooq

2 1

LMDB: Estimate number of elements between two keys
by Ken Wenzel 17 Jun '22

17 Jun '22

Dear OpenLDAP-Community, is it possible to compute a rough estimate of the number of elements between two given keys for an LMDB database? Currently, I scan the first 1000 keys and extrapolate the count based on the average distance of the keys. Maybe it is also possible to use some information about the common b-tree pages that are shared by both keys? We need this functionality for query optimization within RDF4J. Thank you for your support and best regards, Ken Wenzel

2 2

need help to make OpenLDAP work as "this other directory, plus"
by jarett＠bioteam.net 17 Jun '22

17 Jun '22

Hi all. So, I'm trying to basically put a band-aid over an intentionally broken LDAP implementation. We use Okta as our single source of truth for directory services, and its implementation of LDAP intentionally leaves out uidNumber and gidNumber (and you can't change this) in order to force you to use their insanely expensive "Advanced Server Access" product. This $9500/yr expense for a minimum of 50 machines is a non-starter for the lab project we are trying to get working with LDAP. We're only talking about ~10 machines here and we very much want them to be ultimately authenticating against Okta for their passwords -- because this automatically MFAs them by default, and prevents credential proliferation for the services we run in the lab. So basically what I want to do is set up an LDAP server which passes just about everything through to Okta, but keeps consistent uidNumber and gidNumber values for each user in Okta who logs in. I think this is possible either with the "meta" backend or the "ldap" backend or both, but I'm not clear on how to configure these. I've followed this guide to get OpenLDAP working on a Rocky 8 server: https://kifarunix.com/install-and-setup-openldap-on-rocky-linux-8/ But that guide does not contain instructions for something like this, and even the OpenLDAP documentation is scarce when it comes to configuring backends. e.g.: https://www.openldap.org/doc/admin26/backends.html#LDAP even just for LDAP there is no indication of how I would introduce the bind DN for the backend LDAP or how it would know what to add, and the "meta" backend has no implementation details at all: https://www.openldap.org/doc/admin26/backends.html#Metadirectory Help? Thanks!

3 2

logsuccess FALSE vs. replica contextCSN
by Geert Hendrickx 17 Jun '22

17 Jun '22

Hi Some time ago we switched our MMR config to "logsuccess FALSE" to let us record and investigate some (client-side) issues with unique constraint. This records updates refused by unique constraint in the accesslog, so we can look into them. We have logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" in each syncrepl statement, so those failed updates don't propagate through the replication. We noticed though that other failed updates, not due to unique constraint, such as adding an already existing object, or deleting a non-existing one, do cause a contextCSN update *on all replica's* but *not* in the provider, leading to contextCSN divergence - at least when no further updates happen on that provider. This usually remains hidden as other updates to the same provider keep increasing its contextCSN, but becomes apparant when no further updates happen on that provider (in this case because we were switching providers). Eg. when adding an object that already exists, the provider refused the update (error 68, already exists) and logs the following to the accesslog: > dn: reqStart=20220616095229.000003Z,cn=accesslog > objectClass: auditAdd > reqStart: 20220616095229.000003Z > reqEnd: 20220616095229.000004Z > reqType: add > reqSession: 1498 > reqAuthzID: <...> > reqDN: <some already existing object> > reqResult: 68 > reqMod: <...> > reqMod: entryCSN:+ 20220616095229.618035Z#000000#001#000000 and its main db is not updated. But the replica's log the following: > dn: reqStart=20220616095229.000006Z,cn=accesslog > objectClass: auditModify > reqStart: 20220616095229.000006Z > reqEnd: 20220616095229.000007Z > reqType: modify > reqSession: 1 > reqAuthzID: <...> > reqDN: <root DN> > reqResult: 0 > reqMod: contextCSN:= 20220616095229.618035Z#000000#001#000000 And thus update the contextCSN of their root DN (despite no other changes to the main db) - their contextCSN is now different than the provider's. This obviously only happens with "logsuccess FALSE", but even in that case this should not be expected behaviour; refused updates should not change anything except getting logged to the accesslog? This is with OpenLDAP 2.5.12 (migrating from 2.4.x) Geert

2 8

[OPENLDAP 2.4] problem with cacert.pem certificates and its operation with openldap
by fredd fredddo 17 Jun '22

17 Jun '22

Hello, I have a problem understanding how cacert.pem works on openldap 2.4 under centos. I have an extremely heterogeneous machine park (with openldap customers and other owners) So I have 2 Certificates (CA and intermediate CA) self-signed with the MD5withRSA algorithm and the same 2 certificates self-signed with the SHA1withRSA algorithm. The 4 certificates are therefore in the cacert.pem of the server and the clients. (keystore) It works perfectly for old servers but for new ones I have to force the use of TLS 1.1 because of the algorithms. I have two problems: If I just paste the 2 certificates in MD5 in the client keystore, it works, but if I leave the 2 certificates in SHA1, it does not work (bad certificate). I don't understand how openldap reads the file when there are multiple choices . He starts with the first couple, if that doesn't work he goes to the next one? So the idea would be to generate 2 new certificates identical to the others but with a SHA254 signature for example to work in TLS 1.2/1.3 and keep ldap compatibility with old servers. The cacert.pem file of the OpenLDAP server would therefore have 6 certificates and the clients following their OS would have the appropriate pair of certificates. Could this work? or for clients I leave the cacert the same and it will choose what it needs to establish the TLS connection? I am a little lost ... best regards Fred,

2 1

OpenLDAP pcacheBind is not refresh
by Tri Tu 15 Jun '22

15 Jun '22

hello everyone, I'm having issue with the pcachBind that it's not getting update from the upstream proxy ldap. The use case is that after users have updated userPassword on the upstream LDAP, the new password is updated and it's authenticated correctly with the updated password when directly query the upstream LDAP. But with the proxyldap pcache setting that I have with 3 attributes set of pcache configuration as below: overlay pcache pcache hdb 100000 3 1000 60 pcacheAttrset 0 + pcacheTemplate (uid=) 0 120 0 0 30 pcacheTemplate (&(uid=)(objectClass=)) 0 60 0 0 30 pcacheTemplate (&(objectClass=)(uidNumber=)) 0 60 0 0 30 pcacheTemplate (&(uid=)(memberOf=)) 0 60 0 0 30 pcacheBind (uid=) 0 30 sub "o=mycompany.com" pcacheAttrset 1 memberOf pcacheTemplate (objectClass=*) 1 360 0 0 30 pcacheTemplate (uid=) 1 360 0 0 30 pcacheBind (uid=) 1 30 sub "o=mycompany.com" pcacheAttrset 2 memberOf member pcacheTemplate (uid=) 2 360 0 0 30 pcacheBind (uid=) 2 30 sub "o=mycompany.com" pcacheOffline TRUE pcacheValidate TRUE The cacheable template for uid= is set with TTL 120 and TTR at 30. The first time query to the proxy pcache server, it's cached uid= data Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: activity on 1 descriptor Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: activity on: Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: slap_listener_activate(8): Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=8 busy Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=11 active_threads=0 tvp=NULL Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: >>> slap_listener(ldap:///) Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: listen=8, new connection on 13 Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: added 13r (active) listener=(nil) Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: conn=1000 fd=13 ACCEPT from IP=10.239.134.126:60966 (IP=0.0.0.0:389) Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: activity on 2 descriptors Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: activity on: Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: 13r Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: read active on 13 Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=11 active_threads=0 tvp=NULL Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: connection_get(13) Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: connection_get(13): got connid=1000 Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: connection_read(13): checking for input on id=1000 Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: op tag 0x60, time 1655184692 Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: conn=1000 op=0 do_bind Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: >>> dnPrettyNormal: <uid=userX,ou=employees,o=mycompany.com> Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: <<< dnPrettyNormal: <uid=userX,ou=employees,o=mycompany.com>, <uid=userX,ou=employees,o=mycompany.com> Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: conn=1000 op=0 BIND dn="uid=userX,ou=employees,o=mycompany.com" method=128 Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: do_bind: version=3 dn="uid=userX,ou=employees,o=mycompany.com" method=128 Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: => bdb_entry_get: ndn: "uid=userX,ou=employees,o=mycompany.com" Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: => bdb_entry_get: oc: "(null)", at: "(null)" Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: bdb_dn2entry("uid=userX,ou=employees,o=mycompany.com") Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: => hdb_dn2id("o=mycompany.com") Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: <= hdb_dn2id: got id=0x1 Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: => hdb_dn2id("ou=employees,o=mycompany.com") Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: <= hdb_dn2id: got id=0x2 Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: => hdb_dn2id("uid=userX,ou=employees,o=mycompany.com") Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: <= hdb_dn2id: got id=0x3 Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: entry_decode: "" Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: <= entry_decode() Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: => bdb_entry_get: found entry: "uid=userX,ou=employees,o=mycompany.com" Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: bdb_entry_get: rc=0 Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: str2filter "(uid=userX)" Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: begin get_filter Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: EQUALITY Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: end get_filter 0 Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: Lock QC index = 0x5638d82e9910 Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: Not answerable: Unlock QC index=0x5638d82e9910 Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: QUERY NOT ANSWERABLE Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: QUERY CACHEABLE Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: =>ldap_back_getconn: conn=1000 op=0: lc=0x7f8710109d80 inserted refcnt=1 rc=0 Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: activity on 1 descriptor Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: activity on: Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Jun 14 05:31:32 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=11 active_threads=0 tvp=NULL Jun 14 05:31:33 prd-ldap1-euc1 slapd[7178]: => ldap_back_munge_filter "(uid=userX)" Jun 14 05:31:33 prd-ldap1-euc1 slapd[7178]: <= ldap_back_munge_filter "(uid=userX)" (0) Jun 14 05:31:33 prd-ldap1-euc1 slapd[7178]: >>> dnPrettyNormal: <uid=userX,OU=employees,O=mycompany.com> Jun 14 05:31:33 prd-ldap1-euc1 slapd[7178]: <<< dnPrettyNormal: <uid=userX,ou=employees,o=mycompany.com>, <uid=userX,ou=employees,o=mycompany.com> Jun 14 05:31:33 prd-ldap1-euc1 slapd[7178]: >>> dnPretty: <CN=cie_ldap_test,OU=Groups,O=mycompany.com> Jun 14 05:31:33 prd-ldap1-euc1 slapd[7178]: <<< dnPretty: <cn=cie_ldap_test,ou=Groups,o=mycompany.com> Jun 14 05:31:33 prd-ldap1-euc1 slapd[7178]: >>> dnPretty: <CN=hps_opsinf_admin,OU=Groups,O=mycompany.com> Jun 14 05:31:33 prd-ldap1-euc1 slapd[7178]: <<< dnPretty: <cn=hps_opsinf_admin,ou=Groups,o=mycompany.com> Jun 14 05:31:33 prd-ldap1-euc1 slapd[7178]: >>> dnNormalize: <cn=cie_ldap_test,ou=Groups,o=mycompany.com> Jun 14 05:31:33 prd-ldap1-euc1 slapd[7178]: <<< dnNormalize: <cn=cie_ldap_test,ou=Groups,o=mycompany.com> Jun 14 05:31:33 prd-ldap1-euc1 slapd[7178]: >>> dnNormalize: <cn=hps_opsinf_admin,ou=Groups,o=mycompany.com> Jun 14 05:31:33 prd-ldap1-euc1 slapd[7178]: <<< dnNormalize: <cn=hps_opsinf_admin,ou=Groups,o=mycompany.com> But any sub-sequence queries after that it's always using the entry that found in the cached (CACHED BIND) instead of re-query with new connection to the upstream LDAP as it's expired (longer that TTL/TTR). Same situation when users change password from the upstream LDAP, the proxy ldap doesn't take the update password. Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: activity on 1 descriptor Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: activity on: Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: slap_listener_activate(8): Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=8 busy Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=11 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: >>> slap_listener(ldap:///) Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: listen=8, new connection on 13 Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: activity on 1 descriptor Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: activity on: Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=11 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: added 13r (active) listener=(nil) Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: activity on 1 descriptor Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: activity on: Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: conn=1001 fd=13 ACCEPT from IP=10.239.134.126:60993 (IP=0.0.0.0:389) Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: 13r Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: read active on 13 Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=11 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: activity on 1 descriptor Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: activity on: Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=11 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: connection_get(13) Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: connection_get(13): got connid=1001 Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: connection_read(13): checking for input on id=1001 Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: op tag 0x60, time 1655184873 Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: conn=1001 op=0 do_bind Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: >>> dnPrettyNormal: <uid=userX,ou=employees,o=mycompany.com> Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: <<< dnPrettyNormal: <uid=userX,ou=employees,o=mycompany.com>, <uid=userX,ou=employees,o=mycompany.com> Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: conn=1001 op=0 BIND dn="uid=userX,ou=employees,o=mycompany.com" method=128 Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: do_bind: version=3 dn="uid=userX,ou=employees,o=mycompany.com" method=128 Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => bdb_entry_get: ndn: "uid=userX,ou=employees,o=mycompany.com" Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => bdb_entry_get: oc: "(null)", at: "(null)" Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: bdb_dn2entry("uid=userX,ou=employees,o=mycompany.com") Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => bdb_entry_get: found entry: "uid=userX,ou=employees,o=mycompany.com" Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: bdb_entry_get: rc=0 Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: str2filter "(uid=userX)" Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: begin get_filter Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: EQUALITY Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: end get_filter 0 Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: Lock QC index = 0x5638d82e9910 Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: QUERY ANSWERABLE (answered 1 times) Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => hdb_search Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: bdb_dn2entry("uid=userX,ou=employees,o=mycompany.com") Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => access_allowed: search access to "uid=userX,ou=employees,o=mycompany.com" "entry" requested Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: <= root access granted Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => access_allowed: search access granted by manage(=mwrscxd) Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: base_candidates: base: "uid=userX,ou=employees,o=mycompany.com" (0x00000003) Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => test_filter Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: EQUALITY Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => access_allowed: search access to "uid=userX,ou=employees,o=mycompany.com" "uid" requested Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: <= root access granted Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => access_allowed: search access granted by manage(=mwrscxd) Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: <= test_filter 6 Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: send_ldap_result: conn=1001 op=0 p=3 Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: send_ldap_result: err=0 matched="" text="" Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: pcache_op_bind: CACHED BIND for uid=userX,ou=employees,o=mycompany.com Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: ==> hdb_bind: dn: uid=userX,ou=employees,o=mycompany.com Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: bdb_dn2entry("uid=userX,ou=employees,o=mycompany.com") Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => access_allowed: result not in cache (userPassword) Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => access_allowed: auth access to "uid=userX,ou=employees,o=mycompany.com" "userPassword" requested Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => dn: [1] Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => dn: [2] cn=subschema Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => acl_get: [3] attr userPassword Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => acl_mask: access to entry "uid=userX,ou=employees,o=mycompany.com", attr "userPassword" requested Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => acl_mask: to value by "", (=0) Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: <= check a_dn_pat: self Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: <= check a_dn_pat: anonymous Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: <= acl_mask: [2] applying auth(=xd) (stop) Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: <= acl_mask: [2] mask: auth(=xd) Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => slap_access_allowed: auth access granted by auth(=xd) Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: => access_allowed: auth access granted by auth(=xd) Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: conn=1001 op=0 BIND dn="uid=userX,ou=employees,o=mycompany.com" mech=SIMPLE ssf=0 Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: do_bind: v3 bind: "uid=userX,ou=employees,o=mycompany.com" to "uid=userX,ou=employees,o=mycompany.com" Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: send_ldap_result: conn=1001 op=0 p=3 Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: send_ldap_result: err=0 matched="" text="" Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: send_ldap_response: msgid=1 tag=97 err=0 Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: conn=1001 op=0 RESULT tag=97 err=0 text= Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: activity on 1 descriptor Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: activity on: Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Jun 14 05:34:33 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=11 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: activity on 1 descriptor Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: activity on: Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: 13r Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: read active on 13 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=11 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: connection_get(13) Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: connection_get(13): got connid=1001 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: connection_read(13): checking for input on id=1001 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: op tag 0x77, time 1655184874 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: conn=1001 op=1 do_extended Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: conn=1001 op=1 EXT oid=1.3.6.1.4.1.4203.1.11.3 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: do_extended: oid=1.3.6.1.4.1.4203.1.11.3 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: conn=1001 op=1 WHOAMI Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: send_ldap_extended: err=0 oid= len=43 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: send_ldap_response: msgid=2 tag=120 err=0 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: conn=1001 op=1 RESULT oid= err=0 text= Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: activity on 1 descriptor Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: activity on: Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=11 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: activity on 1 descriptor Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: activity on: Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: 13r Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: read active on 13 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=11 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: connection_get(13) Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: connection_get(13): got connid=1001 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: connection_read(13): checking for input on id=1001 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: op tag 0x42, time 1655184874 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: ber_get_next on fd 13 failed errno=0 (Success) Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: connection_read(13): input error=-2 id=1001, closing. Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: connection_closing: readying conn=1001 sd=13 for close Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: connection_close: deferring conn=1001 sd=13 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: conn=1001 op=2 do_unbind Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: conn=1001 op=2 UNBIND Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: connection_resched: attempting closing conn=1001 sd=13 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: connection_close: conn=1001 sd=13 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: =>ldap_back_conn_destroy: fetching conn 1001 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: removing 13 Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: conn=1001 fd=13 closed Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: activity on 1 descriptor Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: activity on: Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Jun 14 05:34:34 prd-ldap1-euc1 slapd[7178]: daemon: epoll: listen=11 active_threads=0 tvp=NULL Wondering that if there is anything missing with configuration or if this is a bug that I can file for bug ticket. Thanks, -Tommy

3 5

Search for all user set as manager in my organizational units
by tempo＠net-c.com 15 Jun '22

15 Jun '22

Hi, I have an ldap directory tree with a lot of organizational units. For each of these OUs I set one or multiple "myManager" attributes having as value the DN of the users I want to. I have set dynlist in order to have an attribute myManagerOf on every user object. Now, with one search, I would like to have all the manager "(myManagerOf=*)". But substring filter does not work. Only equality as far as I understand. Of course, as I read in some different topics, it is not feasible using dynlist. I thought that the overlay autogroup would help on that point but at this stage, I'm not able to make it working. Here is my autogroup config so far: dn: olcOverlay={4}autogroup,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcAutoGroupConfig olcOverlay: {4}autogroup olcAutoGroupAttrSet: myOrganizationalUnit memberUrl myManager olcAutoGroupMemberOfAd: myManagerOf I tried to play with this autogroup config and dynlist one, but since I added autogroup, no way to change the myManager attribute, I always face an error. Which I don't have without autogroup: ldap_modify: Constraint violation (19) additional info: attempt to modify dynamic group member attribute If autogroup considers that only "memberUrl" can touch myManager attribute then it sounds logical. However, how could I achieve my goal then ?

1 0

context of slapd service
by Carsten Jäckel 15 Jun '22

15 Jun '22

Hello experts, can you please give me some hints about best practice to run the slapd service? Is it advantageous to run the slapd with it's own service user/group (e. g. ldap:ldap) or is it recommended to run slapd as root (as it seems to be default)? Can you tell me something about advantages/disadvantages of each configuration? Thank you for your support, Carsten

4 3

Bind failures via open ldap proxy for few users -
by shekhar.shrinivasan＠gmail.com 12 Jun '22

12 Jun '22

Hi, We have setup a open ldap proxy with AD backend and we are seeing the following bind error for some users. The only difference in successful bind users versus the failed ones is the addition of square brackets "[]" in the user profile. As seen below for the failed users "X" is inside square brackets. Can you please provide some pointers on this issues. Thanks for your help as always. For example - cn=Terry\2C Troy [X],ou=X Accounts,ou=Users,ou=Users & Groups,dc=or,dc=myorg,dc=org --> BIND FAILED cn=CN=Meza\, Rosalinda X,ou=X Accounts,ou=Users,ou=Users & Groups,dc=or,dc=myorg,dc=org --> BIND SUCCESS slapd[15544]: conn=3206402 op=6 BIND dn="cn=Terry\2C Troy [X],ou=X Accounts,ou=Users,ou=Users & Groups,dc=or,dc=myorg,dc=org" method=128 slapd[15544]: conn=3206402 op=6 meta_back_search[3] match="OU=X Accounts,OU=Users,OU=Users & Groups,dc=or,dc=myorg,dc=org" err=32 (No such object) text="0000208D: NameErr: DSID-03100241, problem 2001 (NO_OBJECT), data 0, best match of:#012#011'OU=X Accounts,OU=Users,OU=Users & Groups,DC=or,dc=myorg,DC=org'#012". slapd[15544]: conn=3206402 op=6 meta_back_bind: no target for dn "cn=Terry\2C Troy [X],ou=X Accounts,ou=Users,ou=Users & Groups,dc=or,dc=myorg,dc=org" (32). slapd[15544]: conn=3206402 op=6 RESULT tag=97 err=49 text=

1 0

Failing to modify olcSizeLimit
by RAIMBAULT Alain - Contractor 10 Jun '22

10 Jun '22

Hi, I am trying to modify my DB parameters to fix following issue, root@laselainfldap01p:~# ldaplist passwd ldaplist: libsldap.so.1 internal error LDAP configuration problem: LDAP ERROR (4): Error occurred while receiving results. Size limit exceeded. and libldap returned: (4) using ldaps://laselainfldap01p:636 root@laselainfldap01p:~# To achieve this, I attempted the following but I got priviledge issue accessing the DB .... # cat sizelimit.ldif dn: cn=config changetype: modify replace: olcSizeLimit olcSizeLimit: -1 root@laselainfldap01p:/etc/openldap/slapd.d/cn=config# ldapmodify -v -H ldapi:/// -Y EXTERNAL -f sizelimit.ldif ldap_initialize( ldapi:///??base ) SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 replace olcSizeLimit: -1 modifying entry "cn=config" ldap_modify: Insufficient access (50) root@laselainfldap01p:/etc/openldap/slapd.d/cn=config# root@laselainfldap01p:/etc/openldap/slapd.d/cn=config# ldapmodify -v -h 10.136.16.197 -D "cn=Manager,dc=tosa,dc=thales" -w tco_tosa_thales -f sizelimit.ldif ldap_initialize( ldap://10.136.16.197 ) replace olcSizeLimit: -1 modifying entry "cn=config" ldap_modify: Insufficient access (50) root@laselainfldap01p:/etc/openldap/slapd.d/cn=config#<mailto:root@laselainfldap01p:/etc/openldap/slapd.d/cn=config#> Some priviledge access seems missing but I do not understand how to setup this. Could you, please, provide some directions on this. Kind regards, Alain

4 13

dynlist +memberOf loses casing in memberOf attribute
by Felix Schäfer 07 Jun '22

07 Jun '22

Good evening, We are currently in the process of upgrading our OpenLDAP installation and we have hit a behaviour we can’t explain by perusing the documentation. When using slapo-dynlist to set memberOf attributes the dn of the group the object is a member of gets lowercased. So for example the object that is a member of a group has: === memberOf: ou=kiosk,ou=ags,ou=groups,dc=fsinfo,dc=cs,dc=tu-dortmund,dc=de === Although the group has a dn of: === dn: ou=Kiosk,ou=AGs,ou=groups,dc=fsinfo,dc=cs,dc=tu-dortmund,dc=de === Is this expected behaviour? Is there a setting we overlooked? Is this is a bug in the version shipped with Ubuntu (2.5.6+dfsg-1~exp1ubuntu1.1)? Thank you, Felix

5 21

olcTLSProtocolMin not taking effect
by juan＠quantifind.com 06 Jun '22

06 Jun '22

Hi all - As part of routine security remediation my company asked me to remove the support for older TLS versions from my LDAP server. To this effect I restarted the service after running the following: sudo ldapmodify -Q -Y EXTERNAL -H ldapi:/// -a -f olcTLSProtocolMin.ldif Here is the content of olcTLSProtocolMin.ldif dn: cn=config changetype: modify add: olcTLSProtocolMin olcTLSProtocolMin: 3.3 When I look at the /etc/ldap/slapd.d/cn=config.ldif file I can see the olcTLSProtocolMin: 3.3 entry. however, when I scan the LDAP server using Nessus, the scanner reports older versions of TLS still available. Also if I scan the supported TLS version using nmap it also reports TLS1.0-TLS1.2 If it helps here is the cn=config.ldif file is here dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcLogLevel: stats sync olcPidFile: /var/run/slapd/slapd.pid olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem olcTLSCertificateFile: /etc/ssl/certs/my_cert.pem olcTLSCertificateKeyFile: /etc/ssl/private/my_slapd_key.pem olcToolThreads: 1 structuralObjectClass: olcGlobal entryUUID: SomeUUID creatorsName: cn=config createTimestamp: 20160311213839Z olcTLSProtocolMin: 3.3 entryCSN: 20220601202658.429433Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber Any help will be greatly appreciated. JRosario

2 4

Re: Antw: [EXT] Re: slow memberOf queries in 2.5 with dynlist overlay
by Paul B. Henson 04 Jun '22

04 Jun '22

On 5/30/2022 11:53 PM, Ulrich Windl wrote: > I wonder: Would forcing a core dump help in that situation, or would a > gprof-compile be helpful? Unfortunately I can't reproduce it; it just happens randomly on my production boxes, less frequently since I increased the amount of memory on them. I'm not sure I could run a debug or profiling build in production for an extended amount of time waiting for it to happen. And with my luck it would be a heisenbug anyway 8-/. > Maybe one could track down the page fault to some code (function) using tools > from the valgrind family (Cachegrind, callgrind, etc.) > http://www.valgrind.org/docs/manual/manual-core-adv.html#manual-core-adv.va…

1 0

OpenLDAP 2.6.2 on RHEL8: add password policy
by Real Villafan, Elizabeth (US 392K) 02 Jun '22

02 Jun '22

Hello, I'm upgrading from openldap 2.4 running on RHEL7 up to 2.6.2 and RHEL8 on new hardware, apparently the way to configure password policy now is by configuring the slapd.conf file rather than loading the ppolicy schema. How do I modify that file properly? I read https://www.openldap.org/doc/admin26/overlays.html#Password%20Policies on section 12.10.2. Password Policy Configuration, what does it mean to "Instantiate the module in the database"? do you have a sample slapd.conf file I can refer to? Thank you, Liz

2 3

2.5 LTS release with OpenSSL 3.0
by barry.greenberg＠oracle.com 01 Jun '22

01 Jun '22

Is there any information about the release of OpenLDAP 2.5.x that includes support for OpenSSL 3.0? I see that it's now supported in 2.6.2 but we'd prefer to stay on the 2.5 branch for the foreseeable future. Thanks.

1 0

slow memberOf queries in 2.5 with dynlist overlay
by Paul B. Henson 31 May '22

31 May '22

I'm still trying to figure out why my servers sometimes get into a state where queries requesting the memberOf attribute take an exceedingly long time to process, for example: Feb 13 19:46:05 ldap-02 slapd[13564]: conn=297643 fd=104 ACCEPT from PATH=/var/symas/run/ldapi (PATH=/var/symas/run/ldapi) Feb 13 19:46:05 ldap-02 slapd[13564]: conn=297643 op=0 BIND dn="cn=ldaproot,dc=cpp,dc=edu" method=128 Feb 13 19:46:05 ldap-02 slapd[13564]: conn=297643 op=0 BIND dn="cn=ldaproot,dc=cpp,dc=edu" mech=SIMPLE bind_ssf=0 ssf=71 Feb 13 19:46:05 ldap-02 slapd[13564]: conn=297643 op=0 RESULT tag=97 err=0 qtime=0.000006 etime=0.000050 text= Feb 13 19:46:05 ldap-02 slapd[13564]: conn=297643 op=1 SRCH base="dc=cpp,dc=edu" scope=2 deref=0 filter="(uid=henson)" Feb 13 19:46:05 ldap-02 slapd[13564]: conn=297643 op=1 SRCH attr=memberOf Feb 13 19:46:42 ldap-02 slapd[13564]: conn=297643 op=1 SEARCH RESULT tag=101 err=0 qtime=0.000012 etime=36.955710 nentries=1 text= How is the qtime calculated? It is nice and short, despite the wall clock reading over 30 seconds :(. Usually I have to reboot the server completely to clear this up, but this time I just had to restart it, and then the queries were lickity split again: Feb 13 19:55:01 ldap-02 slapd[89655]: conn=1556 fd=40 ACCEPT from PATH=/var/symas/run/ldapi (PATH=/var/symas/run/ldapi) Feb 13 19:55:01 ldap-02 slapd[89655]: conn=1556 op=0 BIND dn="cn=ldaproot,dc=cpp,dc=edu" method=128 Feb 13 19:55:01 ldap-02 slapd[89655]: conn=1556 op=0 BIND dn="cn=ldaproot,dc=cpp,dc=edu" mech=SIMPLE bind_ssf=0 ssf=71 Feb 13 19:55:01 ldap-02 slapd[89655]: conn=1556 op=0 RESULT tag=97 err=0 qtime=0.000009 etime=0.000088 text= Feb 13 19:55:01 ldap-02 slapd[89655]: conn=1556 op=1 SRCH base="dc=cpp,dc=edu" scope=2 deref=0 filter="(uid=henson)" Feb 13 19:55:01 ldap-02 slapd[89655]: conn=1556 op=1 SRCH attr=memberOf Feb 13 19:55:01 ldap-02 slapd[89655]: conn=1556 op=1 SEARCH RESULT tag=101 err=0 qtime=0.000013 etime=0.213149 nentries=1 text= Over 30 seconds elapsed time to .2 seconds? I'd like to see the .2 all the time :). When the server gets like this, there's a very high read IO load, 200-300Mb/s, compared to generally less than 1Mb/s when things are working right. It almost seems like it's doing a full disk scan searching for members every time. Any suggestions on what to dig into? Thanks...

5 16

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical